Fix gss_process_context_token() [CVE-2014-5352] [MITKRB5-SA-2015-001] The krb5 gss_process_context_token() should not actually delete the context; that leaves the caller with a dangling pointer and no way to know that it is invalid. Instead, mark the context as terminated, and check for terminated contexts in the GSS functions which expect established contexts. Also add checks in export_sec_context and pseudo_random, and adjust t_prf.c for the pseudo_random check. (cherry picked from commit 82dc33da50338ac84c7b4102dc6513d897d0506a) https://github.com/krb5/krb5/commit/3cfd4bd9e7c09c3b9024d83ab6e3bba2218eb48b Author: Greg Hudson Committer: Tom Yu Commit: 3cfd4bd9e7c09c3b9024d83ab6e3bba2218eb48b Branch: krb5-1.13 src/lib/gssapi/krb5/context_time.c | 2 +- src/lib/gssapi/krb5/export_sec_context.c | 5 +++++ src/lib/gssapi/krb5/gssapiP_krb5.h | 1 + src/lib/gssapi/krb5/gssapi_krb5.c | 2 +- src/lib/gssapi/krb5/inq_context.c | 2 +- src/lib/gssapi/krb5/k5seal.c | 2 +- src/lib/gssapi/krb5/k5sealiov.c | 2 +- src/lib/gssapi/krb5/k5unseal.c | 2 +- src/lib/gssapi/krb5/k5unsealiov.c | 2 +- src/lib/gssapi/krb5/lucid_context.c | 5 +++++ src/lib/gssapi/krb5/prf.c | 4 ++++ src/lib/gssapi/krb5/process_context_token.c | 17 ++++++++++++----- src/lib/gssapi/krb5/wrap_size_limit.c | 2 +- src/tests/gssapi/t_prf.c | 1 + 14 files changed, 36 insertions(+), 13 deletions(-)