From: Greg Hudson <ghudson@mit.edu>
Date: Sun, 27 Oct 2013 00:17:10 +0000 (-0400)
Subject: Fix decoding of mkey kvno in mkey_aux tl-data
X-Git-Tag: krb5-1.13-alpha1~336
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=64ec2941af1561ef06e7e885b2ffb65a675516ce;p=thirdparty%2Fkrb5.git

Fix decoding of mkey kvno in mkey_aux tl-data

krb5_dbe_lookup_mkey_aux was decoding a 16-bit value directly into an
int, resulting in the wrong value on big-endian platforms.  The
consequences are mostly invisible because we ignore this field and try
all mkey_aux nodes in krb5_def_fetch_mkey_list.

ticket: 7738 (new)
target_version: 1.12
tags: pullup
---

diff --git a/src/lib/kdb/kdb5.c b/src/lib/kdb/kdb5.c
index 8d6374f58b..93293bac19 100644
--- a/src/lib/kdb/kdb5.c
+++ b/src/lib/kdb/kdb5.c
@@ -1628,7 +1628,7 @@ krb5_dbe_lookup_mkey_aux(krb5_context context, krb5_db_entry *entry,
                          krb5_mkey_aux_node **mkey_aux_data_list)
 {
     krb5_tl_data tl_data;
-    krb5_int16 version;
+    krb5_int16 version, mkey_kvno;
     krb5_mkey_aux_node *head_data = NULL, *new_data = NULL,
         *prev_data = NULL;
     krb5_octet *curloc; /* current location pointer */
@@ -1661,7 +1661,8 @@ krb5_dbe_lookup_mkey_aux(krb5_context context, krb5_db_entry *entry,
                 }
                 memset(new_data, 0, sizeof(krb5_mkey_aux_node));
 
-                krb5_kdb_decode_int16(curloc, new_data->mkey_kvno);
+                krb5_kdb_decode_int16(curloc, mkey_kvno);
+                new_data->mkey_kvno = mkey_kvno;
                 curloc += sizeof(krb5_ui_2);
                 krb5_kdb_decode_int16(curloc, new_data->latest_mkey.key_data_kvno);
                 curloc += sizeof(krb5_ui_2);