Ticket History #387: KDC drops core

From jrj@fortress.cc.purdue.edu Tue Mar 11 18:00:59 1997
Received: from MIT.EDU (SOUTH-STATION-ANNEX.MIT.EDU [18.72.1.2]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id SAA26491 for <bugs@RT-11.MIT.EDU>; Tue, 11 Mar 1997 18:00:54 -0500
Received: from [128.210.250.13] by MIT.EDU with SMTP
id AA14352; Tue, 11 Mar 97 18:00:33 EST
Received: (from jrj@localhost)
by fortress.cc.purdue.edu (8.8.5/8.8.5) id RAA29673;
Tue, 11 Mar 1997 17:59:02 -0500 (EST)
Message-Id: <199703112259.RAA29673@fortress.cc.purdue.edu>
Date: Tue, 11 Mar 1997 17:59:02 -0500 (EST)
From: "John R. Jackson" <jrj@fortress.cc.purdue.edu>
Reply-To: jrj@cc.purdue.edu
To: krb5-bugs@MIT.EDU
Subject: KDC drops core
X-Send-Pr-Version: 3.99

Purdue University Computing Center

System: SunOS fortress.cc.purdue.edu 5.5.1 Generic_103640-03 sun4d sparc SUNW,SPARCserver-1000
Architecture: sun4

Since setting up cross realms is completely undocumented :-(, I'm
having to just take wild guesses. During one of these sessions,
I ended up with a setup that causes the KDC to drop core because
of missing error condition tests in krb5_ktkdb_get_entry().

It is trying to look up a principal (I think the host/XXX one)
with the "wrong" kvno (i.e. there is no key with that vno). I
don't know why it is trying to do this (i.e. where it got the kvno
it is trying to use), but the point is that the current code does
not test for krb5_dbm_db_get_mkey() or krb5_dbe_find_enctype()
failing and (as I recall) krb5_dbekd_decrypt_key_data() ends up
dereferencing a NULL pointer.
Sorry, but since I'm flying blind on setting this up, I don't know
how to tell you to reproduce it, but the suggested patch is pretty
self-evident.
Index: keytab.c
===================================================================
RCS file: /usr/src/cvsroot/kerberos/src/lib/kdb/keytab.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 keytab.c
--- keytab.c 1996/12/06 14:54:07 1.1.1.1
+++ keytab.c 1997/02/28 23:35:39
@@ -126,8 +126,11 @@
return KRB5_KT_NOTFOUND;
}
/* match key */
- krb5_dbm_db_get_mkey(context, id->ops, &master_key);
- krb5_dbe_find_enctype(context, &db_entry, enctype, -1, kvno, &key_data);
+ if (kerror = krb5_dbm_db_get_mkey(context, id->ops, &master_key))
+ goto error;
+ if (kerror = krb5_dbe_find_enctype(context, &db_entry, enctype, -1,
+ kvno, &key_data))
+ goto error;
if (kerror = krb5_dbekd_decrypt_key_data(context, master_key, key_data,
&entry->key, NULL))
goto error;

State-Changed-From-To: open-closed
State-Changed-By: tlyu
State-Changed-When: Sun Mar 16 02:41:47 1997
State-Changed-Why:

Dup of krb5-kdc/361; followups should go there.