From: Greg Hudson <ghudson@mit.edu>
Date: Fri, 27 Apr 2012 17:04:24 +0000 (+0000)
Subject: Ensure null termination of AFS salts
X-Git-Tag: krb5-1.10.4-final~18
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a79e78cdcfa70d48a9357bbe16a3323b899c8219;p=thirdparty%2Fkrb5.git

Ensure null termination of AFS salts

Use krb5int_copy_data_contents_add0 when copying a pa-pw-salt or
pa-afs3-salt value in pa_salt().  If it's an afs3-salt, we're going to
throw away the length and use strcspn in krb5int_des_string_to_key,
which isn't safe if the value is unterminated.

(cherry picked from commit f566fee75f2455d6e5e7ee4fcdf5a0d327808639)

ticket: 7537 (new)
version_fixed: 1.10.4
status: resolved
---

diff --git a/src/lib/krb5/krb/preauth2.c b/src/lib/krb5/krb/preauth2.c
index d43c20ebc8..625ee4d640 100644
--- a/src/lib/krb5/krb/preauth2.c
+++ b/src/lib/krb5/krb/preauth2.c
@@ -548,7 +548,7 @@ pa_salt(krb5_context context, krb5_kdc_req *request, krb5_pa_data *in_padata,
 
     tmp = padata2data(*in_padata);
     krb5_free_data_contents(context, salt);
-    retval = krb5int_copy_data_contents(context, &tmp, salt);
+    retval = krb5int_copy_data_contents_add0(context, &tmp, salt);
     if (retval)
         return retval;