From: Ben Kaduk <kaduk@mit.edu>
Date: Fri, 31 Aug 2012 21:48:14 +0000 (-0400)
Subject: Do not retrieve zero-length creds
X-Git-Tag: kfw-4.0-final~11
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4e51366fc61b54ca84b3f48cd2abc0ba62852a7b;p=thirdparty%2Fkrb5.git

Do not retrieve zero-length creds

In the MSLSA cache, if we get back a zero-length ticket, don't
accept it as success; continue on to try and get an acceptable
ticket.

(cherry picked from commit cd58adf4b0f52d0293ec8bf9d7d3e87bd1e6ce3f)

ticket: 7349
version_fixed: 1.10.4
status: resolved
---

diff --git a/src/lib/krb5/ccache/cc_mslsa.c b/src/lib/krb5/ccache/cc_mslsa.c
index 39d78e78ea..d692b42700 100644
--- a/src/lib/krb5/ccache/cc_mslsa.c
+++ b/src/lib/krb5/ccache/cc_mslsa.c
@@ -2489,7 +2489,8 @@ krb5_lcc_retrieve(krb5_context context, krb5_ccache id, krb5_flags whichfields,
 
     /* first try to find out if we have an existing ticket which meets the requirements */
     kret = krb5_cc_retrieve_cred_default (context, id, whichfields, mcreds, creds);
-    if ( !kret )
+    /* This sometimes returns a zero-length ticket; work around it. */
+    if ( !kret && creds->ticket.length > 0 )
         return KRB5_OK;
 
     /* if not, we must try to get a ticket without specifying any flags or etypes */
@@ -2506,7 +2507,8 @@ krb5_lcc_retrieve(krb5_context context, krb5_ccache id, krb5_flags whichfields,
 
     /* try again to find out if we have an existing ticket which meets the requirements */
     kret = krb5_cc_retrieve_cred_default (context, id, whichfields, mcreds, creds);
-    if ( !kret )
+    /* This sometimes returns a zero-length ticket; work around it. */
+    if ( !kret && creds->ticket.length > 0 )
         goto cleanup;
 
     /* if not, obtain a ticket using the request flags and enctype even though it may not