[SSSD] [PATCH] KRB5: Refactor cc_*_check_existing

Stephen Gallagher sgallagh at redhat.com
Thu Aug 15 15:50:14 UTC 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

There was duplicated code in cc_file_check_existing() and in
cc_dir_check_existing(). I pulled them into the same function.

There are two changes made to the original code here:
1) Fixes a use-after-free bug in cc_file_check_existing(). In the
original code, we called krb5_free_context() and then used that
context immediately after that in krb5_cc_close(). This patch
corrects the ordering

2) The krb5_cc_resolve() call handles KRB5_FCC_NOFILE for all
cache types. Previously, this was only handled for DIR caches.

This second part I need someone with Kerberos knowledge to verify. Is
there a risk of receiving this error for the FILE or KEYRING types,
and if so is this handling still acceptable or should they be
special-cased?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlIM+LYACgkQeiVVYja6o6MNjACfSxhKZIq3nr9YSG3lro9kKQ2A
zIIAni3Px6SSQ9CU/x3ltMW2VTJ1Scan
=pTjc
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-KRB5-Refactor-cc_-_check_existing.patch
Type: text/x-patch
Size: 6150 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130815/add4e779/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-KRB5-Refactor-cc_-_check_existing.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20130815/add4e779/attachment.sig>


More information about the sssd-devel mailing list