commit 4ba8cb9423ae395ed48d896890e876f1247412d7
Author: tlyu <tlyu@dc483132-0cff-0310-8789-dd5450dbe970>
Date: Fri May 28 18:41:45 2010 +0000
ticket: 6734
version_fixed: 1.8.2
status: resolved
pull up r24102 from trunk
------------------------------------------------------------------------
r24102 | ghudson | 2010-05-24 22:44:45 -0400 (Mon, 24 May 2010) | 11 lines
ticket: 6734
subject: FAST negotiation could erroneously succeed
target_version: 1.8.2
tags: pullup
When FAST negotiation is performed against an older KDC
(rep->enc_part2->flags & TKT_FLG_ENC_PA_REP not set),
krb5int_fast_verify_nego did not set the value of *fast_avail, causing
stack garbage to be used in init_creds_step_reply. Initialize
*fast_avail at the beginning of the function per coding practices.
git-svn-id:
svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@24111
dc483132-0cff-0310-8789-dd5450dbe970
src/lib/krb5/krb/fast.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/src/lib/krb5/krb/fast.c b/src/lib/krb5/krb/fast.c
index 1ff2d67..e991261 100644
--- a/src/lib/krb5/krb/fast.c
+++ b/src/lib/krb5/krb/fast.c
@@ -572,6 +572,7 @@ krb5int_fast_verify_nego(krb5_context context,
krb5_data scratch;
krb5_boolean valid;
+ *fast_avail = FALSE;
if (rep->enc_part2->flags& TKT_FLG_ENC_PA_REP) {
pa = krb5int_find_pa_data(context, rep->enc_part2->enc_padata,
KRB5_ENCPADATA_REQ_ENC_PA_REP);