From: Tomas Kuthan <tkuthan@gmail.com>
Date: Wed, 30 Sep 2015 13:18:05 +0000 (+0200)
Subject: Check output params on GSS OID set functions
X-Git-Tag: krb5-1.12.5-final~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fae5e7f02f82fb08e1e8ccfcc95dfc782716124f;p=thirdparty%2Fkrb5.git

Check output params on GSS OID set functions

Add sanity checks for the output parameters of
generic_gss_create_empty_oid_set() and
generic_gss_add_oid_set_member(), which are used directly by the API
functions gss_create_empty_oid_set() and gss_add_oid_set_member().

[ghudson@mit.edu: edit commit message]

(cherry picked from commit c9e035794caa784b6cdf416e2b3f1d641d011390)

ticket: 8325 (new)
version_fixed: 1.12.5
status: resolved
---

diff --git a/src/lib/gssapi/generic/oid_ops.c b/src/lib/gssapi/generic/oid_ops.c
index 1229f3842b..a0b6dcbaa5 100644
--- a/src/lib/gssapi/generic/oid_ops.c
+++ b/src/lib/gssapi/generic/oid_ops.c
@@ -137,6 +137,9 @@ generic_gss_create_empty_oid_set(OM_uint32 *minor_status, gss_OID_set *oid_set)
 {
     *minor_status = 0;
 
+    if (oid_set == NULL)
+        return GSS_S_CALL_INACCESSIBLE_WRITE;
+
     if ((*oid_set = (gss_OID_set) gssalloc_malloc(sizeof(gss_OID_set_desc)))) {
         memset(*oid_set, 0, sizeof(gss_OID_set_desc));
         return(GSS_S_COMPLETE);
@@ -161,6 +164,9 @@ generic_gss_add_oid_set_member(OM_uint32 *minor_status,
         member_oid->elements == NULL)
         return (GSS_S_CALL_INACCESSIBLE_READ);
 
+    if (oid_set == NULL)
+        return GSS_S_CALL_INACCESSIBLE_WRITE;
+
     elist = (*oid_set)->elements;
     /* Get an enlarged copy of the array */
     if (((*oid_set)->elements = (gss_OID) gssalloc_malloc(((*oid_set)->count+1) *