content-type: text/plain; charset="utf-8"
X-RT-Original-Encoding: utf-8
Content-Length: 1178

I have run into a segfault bug with krb5-1.17.1 and earlier versions at:

lib/krb5/krb/authdata.c, line 562 :

          for (n_elements = 0; elements[n_elements] != NULL; n_elements++);

The segfault occurs because elements is NULL.

This is due to the earlier call to k5_unwrap_cammac_svc() that returns
KRB5KRB_AP_ERR_BAD_INTEGRITY and leaves elements as NULL:

lib/krb5/krb/authdata.c, line 556 :

        ret = k5_unwrap_cammac_svc(kcontext, cammacs[i], key, &elements);
          if (ret && ret != KRB5KRB_AP_ERR_BAD_INTEGRITY)

The issue is fixable with the following patch, but the bypassing of the
KRB5KRB_AP_ERR_BAD_INTEGRITY result is suspect:

--- krb5-1.17.1/src/lib/krb5/krb/authdata.c     2019-12-11
10:13:10.000000000 -0700
+++ krb5-1.17.1/src/lib/krb5/krb/authdata.c.    2019-12-18
11:27:06.555957314 -0700
@@ -558,6 +558,8 @@
             goto cleanup;
         ret = 0;

+        if ( elements == NULL ) continue;
+
         /* Add the verified elements to list and free the container array.
*/
         for (n_elements = 0; elements[n_elements] != NULL; n_elements++);
         new_list = realloc(list, (count + n_elements + 1) * sizeof(*list));


--Jeffrey