From: Michael Saxl <mike@mwsys.mine.bz>
Date: Sat, 24 Jun 2017 11:41:48 +0000 (+0200)
Subject: s3:gse_krb5: fix a possible crash in fill_mem_keytab_from_system_keytab()
X-Git-Tag: samba-4.5.11~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=96450f9849abdae36f82fe1e5a21492555b9aff1;p=thirdparty%2Fsamba.git

s3:gse_krb5: fix a possible crash in fill_mem_keytab_from_system_keytab()

If the keytab file isn't readable, we may call
krb5_kt_end_seq_get() with an invalid kt_cursor.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10490

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Michael Saxl <mike@mwsys.mine.bz>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
(cherry picked from commit a9780a2eaa9cba4ab87cc3371d97fa494fa0198c)
---

diff --git a/source3/librpc/crypto/gse_krb5.c b/source3/librpc/crypto/gse_krb5.c
index e0021d08b56..16679161d18 100644
--- a/source3/librpc/crypto/gse_krb5.c
+++ b/source3/librpc/crypto/gse_krb5.c
@@ -447,6 +447,14 @@ static krb5_error_code fill_mem_keytab_from_system_keytab(krb5_context krbctx,
 	if (ret) {
 		DEBUG(1, (__location__ ": krb5_kt_start_seq_get failed (%s)\n",
 			  error_message(ret)));
+		/*
+		 * krb5_kt_start_seq_get() may leaves bogus data
+		 * in kt_cursor. And we want to use the all_zero()
+		 * logic below.
+		 *
+		 * See bug #10490
+		 */
+		ZERO_STRUCT(kt_cursor);
 		goto out;
 	}