From 9c6372f8fe787ceacc471d3e6242b169be9d06dd Mon Sep 17 00:00:00 2001 From: Michael Saxl Date: Sat, 24 Jun 2017 13:41:48 +0200 Subject: [PATCH] s3:gse_krb5: fix a possible crash in fill_mem_keytab_from_system_keytab() If the keytab file isn't readable, we may call krb5_kt_end_seq_get() with an invalid kt_cursor. BUG: https://bugzilla.samba.org/show_bug.cgi?id=10490 Pair-Programmed-With: Stefan Metzmacher Signed-off-by: Michael Saxl Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider (cherry picked from commit a9780a2eaa9cba4ab87cc3371d97fa494fa0198c) --- source3/librpc/crypto/gse_krb5.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/source3/librpc/crypto/gse_krb5.c b/source3/librpc/crypto/gse_krb5.c index e0021d0..1667916 100644 --- a/source3/librpc/crypto/gse_krb5.c +++ b/source3/librpc/crypto/gse_krb5.c @@ -447,6 +447,14 @@ static krb5_error_code fill_mem_keytab_from_system_keytab(krb5_context krbctx, if (ret) { DEBUG(1, (__location__ ": krb5_kt_start_seq_get failed (%s)\n", error_message(ret))); + /* + * krb5_kt_start_seq_get() may leaves bogus data + * in kt_cursor. And we want to use the all_zero() + * logic below. + * + * See bug #10490 + */ + ZERO_STRUCT(kt_cursor); goto out; } -- 1.9.1