From: Greg Hudson Date: Wed, 31 Jul 2019 20:18:11 +0000 (-0400) Subject: Handle all-zero tags in file2 rcache type X-Git-Tag: krb5-1.18-beta1~86 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6e1fdfb30bac750816da25d6dd4ed67d0149da12;p=thirdparty%2Fkrb5.git Handle all-zero tags in file2 rcache type In the unlikely case of an all-zero tag, rc_file2.c:store() could mistake an empty record for a replay. Check that records from the file are non-empty (by checking that the timestamp is non-zero) before comparing them to the tag. ticket: 8786 --- diff --git a/src/lib/krb5/rcache/rc_file2.c b/src/lib/krb5/rcache/rc_file2.c index 10f9a92811..3240776064 100644 --- a/src/lib/krb5/rcache/rc_file2.c +++ b/src/lib/krb5/rcache/rc_file2.c @@ -174,8 +174,8 @@ store(krb5_context context, int fd, const uint8_t tag[TAG_LEN], uint32_t now, if (ret) return ret; - if ((nread >= 1 && memcmp(r1tag, tag, TAG_LEN) == 0) || - (nread == 2 && memcmp(r2tag, tag, TAG_LEN) == 0)) + if ((nread >= 1 && r1stamp && memcmp(r1tag, tag, TAG_LEN) == 0) || + (nread == 2 && r2stamp && memcmp(r2tag, tag, TAG_LEN) == 0)) return KRB5KRB_AP_ERR_REPEAT; /* Make note of the first record available for writing (empty, beyond