CVE-2022-2031 third_party/heimdal: Check generate_pac() return code

If the function fails, we should not issue a ticket missing the PAC.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>

diff --git a/third_party/heimdal/kdc/kerberos5.c b/third_party/heimdal/kdc/kerberos5.c
index e95bdad0a640e9f93f9910aa124744a9229f4a01..0a7934310cca87457cd2532d8f869c438dc4774f 100644 (file)
--- a/third_party/heimdal/kdc/kerberos5.c
+++ b/third_party/heimdal/kdc/kerberos5.c
@@ -2668,7 +2668,9 @@ _kdc_as_rep(astgs_request_t r)
 
     /* Add the PAC */
     if (!r->et.flags.anonymous) {
-       generate_pac(r, skey, krbtgt_key, is_tgs);
+       ret = generate_pac(r, skey, krbtgt_key, is_tgs);
+       if (ret)
+           goto out;
     }
 
     if (r->client->flags.synthetic) {