krb5 commit: Handle all-zero tags in file2 rcache type
Greg Hudson <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.cvs |
|---|---|
| Message-ID | <[email protected]> |
https://github.com/krb5/krb5/commit/6e1fdfb30bac750816da25d6dd4ed67d0149da12 commit 6e1fdfb30bac750816da25d6dd4ed67d0149da12 Author: Greg Hudson <[email protected]> Date: Wed Jul 31 16:18:11 2019 -0400 Handle all-zero tags in file2 rcache type In the unlikely case of an all-zero tag, rc_file2.c:store() could mistake an empty record for a replay. Check that records from the file are non-empty (by checking that the timestamp is non-zero) before comparing them to the tag. ticket: 8786 src/lib/krb5/rcache/rc_file2.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/lib/krb5/rcache/rc_file2.c b/src/lib/krb5/rcache/rc_file2.c index 10f9a92..3240776 100644 --- a/src/lib/krb5/rcache/rc_file2.c +++ b/src/lib/krb5/rcache/rc_file2.c @@ -174,8 +174,8 @@ store(krb5_context context, int fd, const uint8_t tag[TAG_LEN], uint32_t now, if (ret) return ret; - if ((nread >= 1 && memcmp(r1tag, tag, TAG_LEN) == 0) || - (nread == 2 && memcmp(r2tag, tag, TAG_LEN) == 0)) + if ((nread >= 1 && r1stamp && memcmp(r1tag, tag, TAG_LEN) == 0) || + (nread == 2 && r2stamp && memcmp(r2tag, tag, TAG_LEN) == 0)) return KRB5KRB_AP_ERR_REPEAT; /* Make note of the first record available for writing (empty, beyond