From: Neng Xue <xnsuda@yahoo.com>
Date: Mon, 30 Jun 2014 21:04:56 +0000 (-0700)
Subject: Fix unlikely null dereference in TGS client code
X-Git-Tag: krb5-1.13-alpha1~73
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=81e503c09ad9aef4a0afc6bf66a0269cde2151f3;p=thirdparty%2Fkrb5.git

Fix unlikely null dereference in TGS client code

If krb5_get_tgs_ktypes fails (due to an out-of-memory condition or an
error re-reading the profile), k5_make_tgs_req will dereference a null
pointer.  Check the return value before dereferencing defenctypes.

[ghudson@mit.edu: clarified commit message]

ticket: 7952 (new)
target_version: 1.12.2
tags: pullup
---

diff --git a/src/lib/krb5/krb/send_tgs.c b/src/lib/krb5/krb/send_tgs.c
index cd56366cb2..f6fdf68d47 100644
--- a/src/lib/krb5/krb/send_tgs.c
+++ b/src/lib/krb5/krb/send_tgs.c
@@ -198,7 +198,9 @@ k5_make_tgs_req(krb5_context context,
         req.nktypes = 1;
     } else {
         /* Get the default TGS enctypes. */
-        krb5_get_tgs_ktypes(context, desired->server, &defenctypes);
+        ret = krb5_get_tgs_ktypes(context, desired->server, &defenctypes);
+        if (ret)
+            goto cleanup;
         for (count = 0; defenctypes[count]; count++);
         req.ktype = defenctypes;
         req.nktypes = count;