From: Tom Yu <tlyu@mit.edu>
Date: Tue, 6 Dec 2011 20:59:16 +0000 (+0000)
Subject: SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
X-Git-Tag: krb5-1.9.3-final~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2ff0f083b4df22dc0b05e66ee0cd1bcbe2c9f5a0;p=thirdparty%2Fkrb5.git

SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]

pull up r25525 from trunk

 ------------------------------------------------------------------------
 r25525 | tlyu | 2011-12-06 15:42:46 -0500 (Tue, 06 Dec 2011) | 8 lines

 ticket: 7042
 subject: SA-2011-007 KDC null pointer deref in TGS handling [CVE-2011-1530]
 target_version: 1.10
 tags: pullup

 Fix a null pointer dereference condition that could cause a denial of
 service.

ticket: 7043
version_fixed: 1.9.3

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-9@25527 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/kdc/Makefile.in b/src/kdc/Makefile.in
index f46cad3da0..102fbaa86b 100644
--- a/src/kdc/Makefile.in
+++ b/src/kdc/Makefile.in
@@ -67,6 +67,7 @@ check-unix:: rtest
 
 check-pytests::
 	$(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS)
+	$(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS)
 
 install::
 	$(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc
diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index c169c54a9f..840a2ef5a7 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -243,7 +243,8 @@ tgt_again:
                     if (!tgs_1 || !data_eq(*server_1, *tgs_1)) {
                         errcode = find_alternate_tgs(request, &server);
                         firstpass = 0;
-                        goto tgt_again;
+                        if (errcode == 0)
+                            goto tgt_again;
                     }
                 }
                 status = "UNKNOWN_SERVER";
diff --git a/src/kdc/t_emptytgt.py b/src/kdc/t_emptytgt.py
new file mode 100644
index 0000000000..1760bcd5a7
--- /dev/null
+++ b/src/kdc/t_emptytgt.py
@@ -0,0 +1,8 @@
+#!/usr/bin/python
+from k5test import *
+
+realm = K5Realm(start_kadmind=False, create_host=False)
+output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1)
+if 'not found in Kerberos database' not in output:
+    fail('TGT lookup for empty realm failed in unexpected way')
+success('Empty tgt lookup.')