In lib/krb5/asn.1/asn1_k_encode.c line 758,  add_optstring is 
defined

#define add_optstring(val,n,fn) \
     if ((val).length >= 0)
{asn1_addlenfield((val).length,(val).data,n,fn);}

The comparison should be > 0 - not >= 0.

The only code affected by this change is the sam challenge encoders.


In draft-ietf-krb-wg-kerberos-sam-01.txt all of the fields are listed as
optional general strings - so a zero length string should not be sent.

If the above change is made - then the krb5_encode_test (tests/asn1)
fails - in the sam code.

I would like to fix both the asn.1 encoder and the test output.