CVE-2022-2031 s4:kpasswd: Account for missing target principal

This field is supposed to be optional.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15049
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15074

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>

diff --git a/source4/kdc/kpasswd-service-mit.c b/source4/kdc/kpasswd-service-mit.c
index 1dbe5adad6da5064b98f176eb536d7d919a935db..670210819a1345cfa0ccc32e5e086ada5a0e3fe7 100644 (file)
--- a/source4/kdc/kpasswd-service-mit.c
+++ b/source4/kdc/kpasswd-service-mit.c
@@ -142,16 +142,18 @@ static krb5_error_code kpasswd_set_password(struct kdc_server *kdc,
                return KRB5_KPASSWD_HARDERROR;
        }
 
-       target_realm = smb_krb5_principal_get_realm(
-               mem_ctx, context, target_principal);
-       code = krb5_unparse_name_flags(context,
-                                      target_principal,
-                                      KRB5_PRINCIPAL_UNPARSE_NO_REALM,
-                                      &target_name);
-       if (code != 0) {
-               DBG_WARNING("Failed to parse principal\n");
-               *error_string = "String conversion failed";
-               return KRB5_KPASSWD_HARDERROR;
+       if (target_principal != NULL) {
+               target_realm = smb_krb5_principal_get_realm(
+                       mem_ctx, context, target_principal);
+               code = krb5_unparse_name_flags(context,
+                                              target_principal,
+                                              KRB5_PRINCIPAL_UNPARSE_NO_REALM,
+                                              &target_name);
+               if (code != 0) {
+                       DBG_WARNING("Failed to parse principal\n");
+                       *error_string = "String conversion failed";
+                       return KRB5_KPASSWD_HARDERROR;
+               }
        }
 
        if ((target_name != NULL && target_realm == NULL) ||