Date: Tue, 14 Feb 2023 18:35:12 GMT From: Cy Schubert <cy@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 8d5dfe721e0f - stable/12 - heimdal: Resolve hdb_free_entry() SIGSEGV/SIGILL Message-ID: <202302141835.31EIZC9T002199@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/12 has been updated by cy: URL: https://cgit.FreeBSD.org/src/commit/?id=8d5dfe721e0f52a2c2379c08356706b05f862927 commit 8d5dfe721e0f52a2c2379c08356706b05f862927 Author: Cy Schubert <cy@FreeBSD.org> AuthorDate: 2023-02-07 15:46:59 +0000 Commit: Cy Schubert <cy@FreeBSD.org> CommitDate: 2023-02-14 18:34:27 +0000 heimdal: Resolve hdb_free_entry() SIGSEGV/SIGILL When the client sends kadmind a create principal (kadm_create) request kadm_s_create_principal() returns an error before zeroing out ent (an hdb entry structure wrapper -- hdb_entry_ex), resulting in a NULL reference. Fix obtained from upstream commit 35ea4955a. PR: 268059 Reported by: Robert Morris <rtm@lcs.mit.edu> Obtained from: Heimdal commit 35ea4955a (cherry picked from commit 6a70e0b4cdc606931555cdc59dc6c8d4a3ab4e3e) --- crypto/heimdal/lib/kadm5/create_s.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/heimdal/lib/kadm5/create_s.c b/crypto/heimdal/lib/kadm5/create_s.c index 04312c024ed3..1033ca103239 100644 --- a/crypto/heimdal/lib/kadm5/create_s.c +++ b/crypto/heimdal/lib/kadm5/create_s.c @@ -65,6 +65,7 @@ create_principal(kadm5_server_context *context, kadm5_principal_ent_rec defrec, *defent; uint32_t def_mask; + memset(ent, 0, sizeof(*ent)); if((mask & required_mask) != required_mask) return KADM5_BAD_MASK; if((mask & forbidden_mask)) @@ -72,7 +73,6 @@ create_principal(kadm5_server_context *context, if((mask & KADM5_POLICY) && strcmp(princ->policy, "default")) /* XXX no real policies for now */ return KADM5_UNK_POLICY; - memset(ent, 0, sizeof(*ent)); ret = krb5_copy_principal(context->context, princ->principal, &ent->entry.principal); if(ret)
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202302141835.31EIZC9T002199>