From: Isaac Boukris <iboukris@gmail.com>
Date: Wed, 7 Nov 2018 20:53:35 +0000 (+0200)
Subject: CVE-2018-16853: fix crash in expired passowrd case
X-Git-Tag: ldb-1.2.4~12
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fcbea2c7c9680ad7e24235150d61f9a0aee36bb4;p=thirdparty%2Fsamba.git

CVE-2018-16853: fix crash in expired passowrd case

When calling encode_krb5_padata_sequence() make sure to
pass a null terminated array as required.

Fixes expired passowrd case in samba4.blackbox.kinit test.

Signed-off-by: Isaac Boukris <iboukris@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 1cd6750f5ab..8283c726487 100644
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -855,7 +855,7 @@ krb5_error_code encode_krb5_padata_sequence(krb5_pa_data *const *rep, krb5_data
 static void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
 {
 	krb5_error_code ret = 0;
-	krb5_pa_data pa, *ppa = NULL;
+	krb5_pa_data pa, *ppa[2];
 	krb5_data *d = NULL;
 
 	if (!e_data)
@@ -876,9 +876,10 @@ static void samba_kdc_build_edata_reply(NTSTATUS nt_status, DATA_BLOB *e_data)
 	SIVAL(pa.contents, 4, 0);
 	SIVAL(pa.contents, 8, 1);
 
-	ppa = &pa;
+	ppa[0] = &pa;
+	ppa[1] = NULL;
 
-	ret = encode_krb5_padata_sequence(&ppa, &d);
+	ret = encode_krb5_padata_sequence(ppa, &d);
 	free(pa.contents);
 	if (ret) {
 		return;