From mdw@quince.ifs.umich.edu Tue Aug 10 04:49:20 1999
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id EAA17441 for <bugs@RT-11.MIT.EDU>; Tue, 10 Aug 1999 04:49:19 -0400
Received: from quince.ifs.umich.edu by MIT.EDU with SMTP
id AA24669; Tue, 10 Aug 99 04:49:30 EDT
Received: (from mdw@localhost) by quince.ifs.umich.edu (8.6.13/8.6.12) id EAA13573; Tue, 10 Aug 1999 04:49:17 -0400
Message-Id: <199908100849.EAA13573@quince.ifs.umich.edu>
Date: Tue, 10 Aug 1999 04:49:17 -0400
From: mdw@umich.edu
Reply-To: mdw@umich.edu
To: krb5-bugs@MIT.EDU
Cc: mdw@umich.edu
Subject: patch to fix kadmind hang and other stuff
X-Send-Pr-Version: 3.99
ITD PD&D Umich Systetms Gruop
Architecture: sun4
Malicious (or confused) users can hang kadmind by
sending bogus network data.
gssapi network data. Kadmind on target system will
go into an infinite CPU loop, and not respond to any
more requests.
M'XL( ';DKS< ^P\:W/;1I+Y2OZ*<;+ED"(I >!35*1$EF1'%5OR27(E6WM;
M* @<4EB1 . DK6)[[=?/P; X$%*\L:I7-5QLR:)Z>[I]_3T#'5Q<GC\[F1[
MZ<3NC8RVK:^^P,LP#6/0ZWT%_YI&OPOO\#(M?C>,X< ROS(&PWYW.##[!HZ;
MW;XU_,KX$LP47ZLH=D*8<C&YWP@'8-/IAG$E##)O@K1_+)-?[G5^)\,[3]Z/
MZU<W7B3@/T?\NO+<6Q')6 13,?&FTTA<R_A>2E\L'H0;3*1P_(FX#:_['7<5
MAM*/.^;N[JYA&>9V_3064^^CC,0B"*6(;QQ?_ N4#)^D^!J^S;X6RS"XGLO%
MMA"GXL:YD\(/8#STY$3$0=U9+N</ Z\Q &AW3F^-Y\[U3.*($0XQW^@&>NA
M=&%8@%R1%_@HPJT,KV481&UB&P@"7POG 8024;" SYX/-*Y7L;@)EG*ZFL\?
MZL'UG1>L(C&;4V"@'+'P)7&(B"CB!#Y,64@I0AFMYK&X!T:!E <?@6:X\K?K
MH%DI5( )SW?GJPF@$A>38%RO 2F!>@&T&8R+6V<"'$VV1<-Q7;F,[4BZMAOX
ML?P8;[MB[OE I[?;;S6WZ[7&M3>3_J2)%"8P-!.=#JM31C%,$\&$4G@Q3"4C
M_]NX7JM%4B[$+(J<I2<<-UXY(*]8122D%P'->1!'J#<7N9)DA6BU7 9A+*3O
MA@_+&!4;/< $"P!$A;*=)Y!!!/[;A6GFP<QS12/CI=D6H3L J8 DB>-/9-C.
M!ETGBOL=TQH!<B.<NL(R>[UT' B?!3'K&K G'C+AS 5/ RQ*WP&G0OG0IL ^
M20,NYB-.$#ZTP3CQ30!F1E\A /0#WYO"#%$;,/$!TR,S(I.>OY)D<C#IA/PG
M404Y-4I<K[_VYD73CNMI2@43@P=$F0\X8/D&10>X"&!&315ESLSQ_ ALM":T
MU$20B*0+.@$/>0O.(/S5 OR;Z8* D4R$"T)OYJ&2IH"WW:S7Y][U#EM^![Q&
MAIZKOKZWU??MFWJM;[;0!$7/ L^HO4.NO04JP/'C.>A4Q;KC0H!!.'&@P.08
M7AC;@%2+'OS8B3V7/,T!,/@F%R!;A!H EU\$H$NPOXP0'"#DQR4$% 9P! X#
M9NA <( L,_!Y30C4TTY5E( 0/11BX2QUGXT?EL"^#_8$0[BWT6I!CT RRS(0
M?B)!6^@F9!&)^M?QT?XY3.87GLZE/XMO,'HP,G.4OE[YMWYP[W\M J(28?Y;
MRA"R#"!O;8FK'T\O!?SW\X^'5^+H\$S\>'CV1OP$"_/IV;'8VJK7!KNC)W#'
M#)75 _D\E+8;@L> 8BQC%VE%F'<IF. Y$/* =(%66=6)L^ 7]!1F"RP%BP@D
MTS@(G1GD1LS(0+FH>.65V83UFMD?D& N^.C*=QDV$%5F*QH-D >D:6<R@= *
MG86,)2T%MS,[@;0QA_ER;E]#1@7WB01,A6H'L*43124_,$=$LS$-P/OFS9(&
M/-\KN5K7)-_A=(D,S -P=8'Y]5JZ#J36@CJ( 7)%3,F"O$,\R!CF[UID'8HY
MJ7)KR<2U[F"@067.D$H3>?^6Y(S&$ %G,BZH/H)%XCX-UG*,1,P5DC!)(XDD
MZ;J0$Q1<U**97 <EPOGTN6BQ2RB4YTJ4H'0PZ(_^4Z:AFOS#3#(TS,=-4O23
MVWX$P<KQ1IR$L#3 <H%K/"\Q$02R"S'4&W)HIR-@7J.+SVZE7$)9Y$ QAEK'
M"0.>CA<B9>.N2?RA3 HF'6&;5(WT>N59^UVVX-Q=S2%!<W&T=MH"\G"01Z;U
M[:G(NXR<\9B,],Q!B<^>\K0*Z)Y9AN[W-6AG/H-%,;Y9),LX (QZ:\CE"?59
MS66XLNE7_I.-/RHS/"PI@\I6=$Z589GD-"ZS.*B6-5Y-IS#,N:4X#'4Q&:B]
MP4+]"G^I4EE_5,G!4Z88F.5 J%4[$ ]3IOA,B40CJ1*A- XE%283+YI!38=%
M1LFFJ]B;VY1:R:IDM4W+# S[\CY;EL;%M:N7QBS"Y08SK'IMU'T*6#6WJ!2]
M$KJ5XM^P#1+>G81=A!/.((\U(BB(H;"5<P_V' [5UQZ67UA284[$M1R*7,H%
M$^<!MQRU!CG?&B7![H+*C&Z:PR%7*IDY;E$(JA$\_\Z9>["1A&*1)&J ?R]Q
M<X!;H]5B65'LJ3E^]=D2W4*M=>>$'FX#R.B37$62KI* 4$S?VVD:KJJKR(%
MC^1K:V:@$-M^A (O2ILI_,G[_R_:^%&OC?T?T^S39^K_] >6V<<6BM4?FO_?
MG5 ]$65).YU.^6D-=]\[AK5CF,(8C8WNN&?6$JJM5FL3AB6,P=@PQE:W_L,/
MHM,WVSU#M."M/Q __% 7\()LBYN2K9VZJ(MO)G**^_FKGR].KT[LT[.KQC(.
MV[B_;XMD-_[?]0[@X4#S'\8_Q;YHP-H3-D4CV:]_WV@ 0O/@P.HUQ_SYI?%Q
M.FTV]W+(YAIDA6T.%-HX?32J)F1M)C0JT4E)%PAU-XB3TDAERR.+UK[H[=5;
M^#WM7'PO&@##SS2%07GFS7R)6WF82B?9SH.;&\!!B"*XM0%\5(+N5D$C,-JX
M56N*L6@\SCPA/(/M,A^;N*X0LI)M384:0FJ7:N<V!_\7W!L%L#[+L<1ZG5=9
M2#S;^.+)UM=9J3"0E3/0Q<GA\>;D@[1PDI2W[[[+5&SUQL( .7Y7T.DKY4^'
M-@=C,=H ;>6@Q6B,+KD6NIN'AM2+'KD^42A!& &MJDD$J#1/:XT,P,C:<>0:
MQ%H[CGR2DGAXG)L8!C9.O(FP]0AC71;LT2!-?&!3C/[Q7K A\C99Z@LJ^M%@
M%)]#@!WE2N:Q%>-/GB(1Z3E3H+@[6UMBX<SG@2ON0V>YE&&TAUW&B$\;TZ.V
M24"[:2K]!/;*0J[_5"F^_DSCKU6*K^7SV:5XI;!8C5<-5!3DO5Q!OAEI($P+
M,,:] =?DO?8 2O)>NVMP2;XE_G8Z^1M^0).T4$CN^U +@[^# OB9C0]M+VI(
M_-#D1$(@JN<A: #\[S<>X[:? A?P\!MO*CA*)HV?+E[U[:/#RRO[\L/[]^<7
M5Y"=?L^/7AP-TD&FB(=FXN3LZ.KO[T\8^>C5D7WYX^&X8AS1L^$:6&D5^N+H
MI\L/[VC\[!0G__$0&/X&0L&;5C!X?'+9S3'X(C=\=HX0&I- !$";>"/1K.
M^--8\%,2>?K51(C&N^-^E0J2X:.+(VV*LBHN+@^1A*8))/6)WQ2T :/P!!(=
M*,G@%"!^@9>@NQ3WWD3Z.[X3AL$]=W?PA.)Z+K'C M$6M>G.@1<+/)&/^&(!
MGC(N/$!I>X:)TO:L87N82(NOA?.O(+3QK'@5 8]O+L'L]NO#T[<?+D[V4JA9
M 'J;.MZ<'[&%$NX +?;<6QEW#N")O73">#MC/%.-LXIO,%O +C[&SWC<Y#IQ
M$#94"FF+!(2_O<2O8(TFDB$A3,HDO9[9-KLD1:V*.:%Y$SA-XP5U0#.%-UCA
MP/>:3)-(!JN^^"VM7#:K*H&BFSO[X+8U]E.^SY*M1=<R5HM1JZS<%BN7W@$=
M[.E-'[*SN+0U[5'_-I1NK+H:2E+=$<0^E%&&8: (B1U59;<O3.45E@GNT.KU
M^WFO@+F!%*E'W)G9'&H,=!#=<!/;#^[;U/FE-78;09-*%!E2VF"'SSKY[,"9
MW4LIH9UJYQE4V*QM\ I\B9>+29_*)%1 [7%?+_@2Z:=KM,T>*&C0P_>\AIYE
M'<:I=VKB2@=5-Z2DQP>>'Z%^@>+%ZHGKAQB/5CQ?W-] ]4#Y%;'](+W@@#=1
MHJ5TO:DG)VV\Y#$+)54Z=$]H'9'6DUA@W;5&:VD\G9'-I$#M@4^7=/BR3A7-
M;7'$UW3P+@S=N?&!18IJPN?^/ZB=5B^TZ^OS"UA]3HXO[?/W5Z?G9Z*!3B^:
MVZDQ<I9!)VNH;-,Y2%23?:+,(%[L:X[ZTQM8XG!M1JM :5Z!S?XIOA.X&<1$
M\BA@(]%5,_/:-*%L<.)7L.MX=7IV?'KVYG*-)P][&.E]8Z0B'6#0'J#X25(;
MY[21Q-R&\[<L\CQ_N8II/!UL@U[H]3*4OQ)^NAU1RJ@>3<*X^4C<;A8Y$>43
M"[_;;_=V07IKM]VW6'Q*$5@77,LYE ZH /6:2)3=!L;LA80R?):H/\UL$/S>
M-!_SRH0'8.NVNOWH:.Z,-V'"P 5R>N;?1"?QA,>I"2WC;O N9$U?SCR0:CUT
M1_-%$KWV!!2KEZV#$.)SV? .>/UA_-PSBH92#X1%A.HI]98]A@1=O7CQ0D!>
M7O2[#D#Y<]HPTU%\R!_9,Q(.U:8HY:M@@;1EP0SE1$Y8U_E375_Q^O ".R6(
ME5,(;0?69N-QO8/9X3G*3A ^6W^,_DP%MMCK._MYOD2+NILUE2L]R-P&[M+R
M0-3Z^BTU7+DR3"80C]8F*9A>*]8HOXF<)@MVS-17>Y(%B6:5JXA,_7B4SA>[
M:'?CX 5H[7IC(M1C'I!0U.J[<&*#^FV:P(::DC9.VBKSDEE*5Q;22"/EPM8V
M9DWQ?0[JI;83&]-.C):7U"D>T7\&IQF 'W[*C/,DY:1R;_(J\9F*48OJ!J4D
M$&L4TJH]7B@S3-$31<X;<4\UG3NS2/S.^$?V\<G;DS?VZ[>';_9H?Q'$PDFT
MA.E<CX;/0T\FOX;J\U9C2WW7?'@BI\YJ'H]INY(\+"X4L.+B2@$5K S#(,PQ
M6*"A/W\"&2U1?B*OH8AC9I)GM%;JVZE/JEQ(IBM@MG2P%#FQBN+-I;J<*X[X
M(_:G5V[,][=BV+9CTY)^W@!ED4<JQ>II,-K%TG%H#=H#?0OTB:D+.8=(_VW#
MWK&3CJG4 G-W#J+5]:U\H)Y!TJE+P-;WFC9"4+N).-X=M4UDN=MK=T=IHX"F
MY5*6KM/MB]&>-H+7"9WY3*NUE>-TN/6TOLNVCJMNQC@9-FN8E( N#G]6'ENE
MG+48&O?>S&?NNWOKQ#4'U?*:>7F%UA1,!=9[IEFS8T-C] FRI!A%Z5-9OHV^
MU0=RTEB]'$XJS;=N@I,D@BIYM"YOM3B%/N[CTB0(GR5,UUHC3+A&F,3GDC24
MVRR2A+A#4KR5-TAINL@U6E2G3,E6':=935-: M;.7H+7<HB>.##_8.8I7#R?
MR,@-O24L?[3AR9_AY'YX\9<\O=$YW'AN,RR=VPQ%04 ^L=$?;3BK&:JSFFKP
MY.94U^1^N+%+_7!C-^L0X#&DNU@VTB-1*CRVZ9<H8>< "\E_F/^D@I+:;@+V
MI5"+=P[PMN^"GC>Q#VDDFWG$[QS$L]B6'Y? %'@+DXP]V&MO@VOC!W(8!I4J
MR!@*'/%Z'KBW6G^YAFYE*\0TEVW1SPVS$H8S>M9*(8'-(0ELCG+-ST]U+2!R
MM/>YH/_3Q"CP0^W/:2C9DMPF]V.]#"3J4.WK 5+X-=%?,$#R''[V'4,EH'[!
MD!]5!,B@\G9A$7P@S.[8W!T;'"!05("[P+^[B;=@1>4Z+B2K!OYDJ<DM"55V
M<;>:A_E-.R8B/XF=Q5)D3K27M/UQ;XB_TTQ^/M'I3 )Q"B4:9D?^>>R-%WTO
M.J!?\5I>(\-)"5AY,%J'*JUT.A5*MRVVRH=6>P)S,F+B6JE*1#N#BS\J; @%
M5(O9Q[JP9?9WU3D:']+?R/E2AND/SB!Q5QWVKCF!$>\OSJ_.<>UH-'2)FDV2
MYOR=O?+\N&MA>W(F8QLXI9T,Q)&&F8'ETD%;<*HJ'.MMX4><@(0:X(E(RQP:
M2BCF @MXF[+(QM\EB/15E$/%JDACEG@HX.,9XW5ZC)'Y4M(CW.*&J=K@<J[R
MX[2[NJ<V>86!MOZX\@2R24VM*E'Q=PWX@P#;A^D?DRECG(:39 >^)A_:K-U1
MGUQFUVR;IO*9=;,"U6FPPE\Q/ZY,KG*JIA6YJWIB"Z^5D"^U5&V/>H(I55L5
ML1^7LY5H,_-B/ #%:D5LL2^EU5I=J!E46<-UWY-4J:?_@E1TS-LL9/R*7T_^
M!;-^F<MGET85@F+V+S^N6 &&N1)I$PJO L-QWR+?[9H&.FV+WODL@8K8B'Y\
M#JB1I:*X+E/J$FJ@YZ?'F;C:<XC\J0QM=96"LWW7VFV;D)"Z7:-M]=-:L) S
M$I70/8PYXF:2\C*#EQNH;;57<4OIMG G0K =DVZLH<BEJPH^+PV"/A;13'^L
M9LJVHUK!J=BHV-EE-QRR>SDG9[^<GJ?-Z:GW<2%?4%E13[9G_/<9<N=5K$ZN
MV^H.Z5WKQV73_KJ">"3E\K8<*64MU9?[XG]*/=6T)YGW/]69UIHMZP!&HH5G
MEMOIW:1:VAEDPM3/5O[+0"UK) ZX6T G0/:[PU^R[D(9'F: C*M/4XDNE)EH
MJX1,KMLJ 66T2TT% -VM@__;)Q<7]NO3D[?']M7Y^=OSLS=-U3]1#>Y-:AJU
M\CP_HK6B/"U11 <]LH4U=6ZTT5/MD\B3!"W^ZI\NUF*'V$D"&X]'@V+04_K!
M0S6^64;;Z![LII-+6<]2?\('56(F!V^2@X)0W)EM0=N?Y.\"30*^>82GXM^G
MG6\]W'%'H/T] RVD>)G%<*!#=5XSN2[FV*$QM0MOIUDU75 IN]2HC^7.I>.O
MEEIW,4M_H$:QN*7L+@3WSZC)SAE?_PM'JP@^\J]_XS!X@"_930RFH()V7QR^
MQ[.S2_O#Y8E]^>'53R=_5S<[S#X6(JU>UTH*DEH.]?<,]]V'JP^';^V+D__Z
M<'IQ<IPFI5RR1.,I J U_ -"$]URI;248U3M2HCJRYPK9G7.2]8#*W,=<"-9
M_ILY!%'0?GJTD9V\P5H,MJ7?F*L;H=,P6'#KA<W EP^3PQ7=YBB_K;H[^59.
M"@GZ26V2P>+]1WWM+Q#-I"D1;E41SL/KQ%.!>3%>+4EF*F;8=^@ Q**8'*1W
M6S,/?YFY/^LSWY=--T1)'7#Z[8+^U%6T O6>@F_[N0C<UF[._"<QJ'%8",(T
M!E^R2BJX)I%[U+X<#-(+3K6JAG/63_ND;\XR =1/3'F1#Y8/=N!-&OGV@59%
MLS;I 88R<_8B.3(].G_W_NW)U4E3M4H&?6HA#8:C)%+UF9-E.KW!B;L?_1)G
M+3E<X[,UBY*?RIJU?-*TVOF,Z>'97LA% <)^D7199:GD9%0_*TC47N CM[FQ
M\IL;S3_R>Z:JFV="@]9MQ5N>9FJ-81^BHS4TS%*0_&][U][4UG'%^R_^%!MG
MP!+W"NOJQ94PSKA8N)[&D!JG3<=E&$"0:(H1 3E#FM+/WCV/?>]]2#@9VEB)
M;6GO[MY]G;-GS_F=LSROQ+J;1A6K;9W>5&3*=EO8'^^P9G').OWQIZSR'&A-
M$O/<>PZ86 EHG T]NSL[1WO[NZ^_'J.G@OL0G[W;W?]V[R5B)5'Q9K*\.AJ_
M^>;=WV6V%SM_&LOE O,"$X+66\G$NGUMO14QLYDRX(K <-8V3UPS+DQ3E:%6
MU+#5%OM<%+[ F!)%I34Q8N<5@46QNU4R-MK:&PY.%@Q.#9NOWZV(O;>Z6Q&3
M;]@M8RB-=JS3\TM&;+]B ?.OW[/0]%O=L=#ZNW"_M TXTJ_KXG[!3+I68*&]
M9R(8]SO-36I9>_FM!?4I3N@9;$'@A<BB,O6&(@QBTG?[;T7[]KSM_A<ZYNFX
M7@]0;ZG:5JJM[ ;:RJ[0G0(=I?H1T4SF*ZH.T$QZ&0=/.T/1WASU-T>9,MN2
MU58Y,:V+;\9O=_??OGFQMS,6^[L4^/!@?_?=WUZ\'6]HISLY:<IU].7XC]^^
M.CH8RY/!U_NO7N^([.DZZ7V>KF.-.U(.NIY^_\-<-'::0K8$L/PXN[L?+R<W
MWV$822EQ[.U@_>RL0\?"H3*7<?@-#N I'KM6M\>://W6P ,N\^QF/IG.-GYX
M;HMN!8I7VB.OKJ<_'9'3E)27*M7MJ&!I=Z'AW;84TES','W^Q;^-HQ68*.2Q
M%@&E7(^^$^9OH(;3UAQD>DYE3:U[I%!N5DNHAN?@E$^]!2]U' 62R'1BOA4%
MN]'QR-)5LBH_0^^>;D=.M1(T> ;!J4TV3(';HR(@SWM%SR1;1 "NDL\!'<BA
MCB'F%YESL']R*G(6)$TK&OR6Q&Y.DC?7&O_9)&1V6*];Y\VQ/((>8SA@94G#
M1W04J'H3)]*K5.:6S*V^KPJ310U2%!EHWM36GGIXK)Y3ZO=,J#A\#=;A-\4,
M0/19+S%;9<(UL<]YC>*#A%9(O!+C/]>8!V$] /5R2Q[GC3FYDVV3+Z?6]++Z
M<+RW_V;\IJE,"N!HF71[RK,.,P/@7"XLY4O")DYJ]P]GQW)J:G5<BN8(\I8%
M<9.F<:A16\DXA'5J0FIO;&3BX/6KO:,77[^RR*>'WIC=0<<@(JB/%.X&XKQL
MV:E=-_6NA.6? XYH?MZ0#%_R]/2QV@9'@F6B[=5;P8*5_/J/R\>I>I*J=-?\
M2EWI;6STQ>[TXL+A _TNF?0V>^K 0;FOCDGQ>75Q/#74#$(.K!9@H'"B(O@L
M1',GV*RGC^&ZP,0HC]= >)@!]*EDS2<MU+V\)<6:S$<A(5"=5.'?>@80+27A
M;57YR=I.L,6F(L6N[X+MHY[7IM4%X=*5MI]@K(])GR-$.JYYVU&O\K+\:J\5
M=B:M+:>V;"VU0GE@MU<GZ>J$MBGYG5](WT!:6)W JGV4V),A?TH"M7]B<?FO
M\FU-O+8VW:T6)090$+BYS!R3+"%S4,Y5:I\UPSH#/FC9LH>N/]EV9)+E"!FK
MHN%0O A^,3O"KS,>LEL:*1:'3'Y;WC*LT//^IB8_LXH5KF?YB2]IM3_P6UAW
M\6[_S]37-P>O+/BZMWT@\]B*/Y0,AK<+L.;EX)^?*<0Z2!@<F :K4#MQRH()
M1TBQ-^NFI< 56C#(00AX.3X0IY9<0,9!8'!2:&HU[%I6<QK%"W3T!7-<'0$.
MQ9Q0@%NA5]!B<E]#*P_D"D<5B[V^.9N[O7:$DA0:CG_%=7/ NJ$P=/SR["?)
MZ]'.PKR9G>#7UL07BIOCZ9^'! O:<1V67N'>$AGI@X+-%F0G\!]X[?;JEQ>\
MUO5D$P/@#D.F8%OCM<E]41%/EN!:>'H'GSFXLH$\7T<"VDI^V]"XIZOM_-;^
M0ZU59/@HP2;*?QL-.&:L-ZG)[]N'85H62>M$TKJ'34?9X5GVN>'.2DQQ^E)!
MQ[RK&9J$FH(;A[I7[Q%XS=E24=9KLA(UEC$B1S591ZW$2DMK"@VFOFCUC+@%
M\VA#32BR@.% RE%);Y"Q.+5BH+_VXL;S$$']6%FIN(1LF",NEG.*Q"\;Z50%
MKUG!9LE]N:(9-.["%MMKO3PHI\E1KWP/;6(PDD_9.(K@U%Z>F1.>:/PT Z]&
M?CN:J*$)>45OZ8,]+J\E[.Z"]#@2QR=PA8IU&\.763U*!#-_0P=PL[L@1KI%
M,I]JKT5N*LFC5I.<Q9,[\627;/D4 ",S<4$)E:W=\DHS^$F]23]VY4T"C_+H
M&>80EP=3CH:R23$2,N,!$=(JI%+*G'^Y<BK0Y"*DL/))Z,#B,=B5'H;[Z0,V
MH!]S;HBO7O0;;G52D9N7+$<MGV+)=^HO>4<Z>$BK.ZI$^A47LFC#_[0&^HBR
M[G<M_Q9VP%0G9!9:4?QIC\SW+D7UPN]/;IZ,2'.+8J7ANR#HH?YP<G8EQ^%&
MS$B^^B=>2P2"Q#%XYLLEVP)%%R0KKISWTDY7-FV0IWW-EKWCGK7&E0NL0U9\
M$-A0Z"):M$F859%46, [2!E7-*)O-WL3C60H%%LT1Z>+Y_Z!2\'86)0UD\65
M^<>XM)UB3:W(\4X/Q#UH2@FZSAY9B[KHT&6=._7P&;((GGE$%GF>53SO5#R/
MT5^E9"C7@0VI;WP/JK&CLQ\_'E\T4#\&JA(T@"/MS2X@"K&-P<?#N6J$\ILG
M@9*773!*L20(KZMBX"Q2#N?"2):T2L/!*=ZC6#DO[K&D>%#/K#NZZ%:^\F7T
MO[!\C!^WJPPR6_&69D5NA;;&1:<E<IY%RZG,"A-7ISPQEZ"*A>?,5;5P1?![
M=GXNV9-61=D*%AV"A?A2@<ZI-F\N8&K+L.G%^W\^I4L,X78J6JRE:[5PH9:N
MTM(E6KH^RQ>G?]97YG^Z[0#C]PWLJ(ZNY4LY;3EA BT>:7MVN8Q23*80PFXZ
MN_RJ/0*M?2K6Z4X8F^$)->$XA3Y;$^[$6GF<C79N]OM0"+CSH 'ZWJ<'"0Y0
MK5O8C=7J& $$U,\2B$#.$ $O*X$$!J/^<-1YZ" !!$3VVZSR*,,'F$?/)->8
M7?],.(#E0 /<9@Q#3&"% 7H @:*@VW.L_N3:0RN?5J3Q*Y53+(\_E K[P]'<
M6 Y$I7G?L^,CHXV9]0WAUM(_L^J./9WT@=IX$859*."5K?2\,YKDQ$("RTF<
MSW\F,/"<[S)V(052,(CA"2JP!(RW!!" 8S^R5/6^2S_C#!RVX<"3FL8ZL1@6
M(=*6A0 (Q(35S8IPUB(;(5R@9:Y/,RS9 ,3 2MH^!*4(?,LP[#ZO+@T%8_LJ
MY^ERGD4V1<4N[FM,/3B^G,K%0'*@,:?VLP&J4;I#Y=VKMIV&BVK#> IK:U(^
M50=2.<)9DX"B_ G+9%BF9<I\L2VZ:N/Q$J&FI+"F)]=/L"ZWF#SO5A8\+2QH
MAS&*!:%PMCF&T[T<[XYWWKW^ZQ@H>KRG"!#'LH.#F/3[@[2CT4CJC&[+DD>T
M_A#TZ<@)[D$^"8MTVIJ,K")DQW4"-M$ *)+4D$/S@E-XP0K2KJY_5=(,NM;I
ME 0M3FX.T(,%[;V.5B</3T%]V:#EY[%J5/RL!A?5XJP!JYS,)C^3]4JK\@SV
MI"BKI\93.)/EJ%37X1I%+5,IDJS.IJVAK@[:''8L[D1 !7W+X8V#6:!(J+8]
M*(4!A'8K54Z_UP,-8]+/\S0;&JVIO_8)'*-@QP7L&DT>BX_1"!H:-5ZY(^<,
MUZ/$'J]PF"*6)GZ+MU$8<Q,9EARE+XF]KOK6A+^-*'P+"]# A:KHHHVQ>J!Y
M^=INFLKXZ?<!U=3VP[#5,:4TEB#2X+[PL24G:6O0[:6]OH%'%1ESU#7R'(V7
M9%-1#JM!1R_ESLCWV=.YVL ZV!EU!PO"9@)Z: 0.5,EQHB*'O\*0*+?(XS'
M\-T%@3QFI=@(>O4 58?>@T\/[O$Q/2L:L--@" 8F,/:B:6_UR.Q"+=0V&]%G
MIW.Y95A@2%9&:C2D!2&2-2EIZ0M"_)V?HR.!R[X*282VBGJB_3(3ZT&/@OVA
M''ED[Q@QX)&P+"UB"5,+?1;AA:9(#E((Z/0Q'Z&>I5#"WL:JD@_RD'9\>CJ[
MGN"..<-(^SK<)X5%&PQ[P*.-Z;"^X5NQ_7N(/($Q< 'K-Y+;R13T_Y/I\248
MEF$@%%<8F?;]]I;"I-027K_EO[$I<= ?PO$CV>P-TN& I;PBV<*( 2VG$;!@
M/EQY5K54N!IC7T-<7=;7&X?FO%K6O&ICWJ>SY2W+MU[XYCQ%%-4&O(@YZ<$9
M8*K,=VH?M6QXC@G/]<6NM.:9;;G$HK>D06\9>UZI.:_JW&H?#XAIH$ZO&8V&
MJ4\(!5Y]]UNEQD+(AL'XZJRR"D9&PEN6T1Q998Y.90YW<2HVAF*-4M6![DJ1
M<PBJ4,Q+;?8KODDQUY9$AMG:JA?A^G-Z14'#HQCKLD9(_W66?BAX'ZJ'_ )W
M7M]C"B+AZ8B$JR;BTX7],M85F:YQNJ4QLK,2>"K6D^OB-Y#Z*/8*K41R,L=>
MHGO_&UEQBR373V+)+7N=;3C%0%[+6$W]G=>GX@H2KJ#?FL2[G QROUT:Y'>X
MMB<073NW]_EC#[=&O#F2$ R/XV@@Q\G.8*:@(E=6*U>G5JYNK5R]6KGZM7(-
M:N7:K)4KKY5K6&]4:PY^O='/Z@U_5F_\LWH3D/4//>7$/65U5Q+4-W9@/)!N
M!^Q)>;YI8+E+GCTB,I@B_;SHS%%0QG0EUV<-LVO3)V( P@YMHH%LV,ULWU#0
MM\_ D/A1"E!P+K?M:DJQ9XG'$+8G &YH$=G%9:1B3:,Y4J/M6:@R#\;A5FFD
MZC6RE#N6L!K":TQRM7$?'^?3BR.>AX>(_+#;MW @6Z=S@/ZP$R+XCZ$3O#:>
M-9^]_D^T^966D-+PLH:W84'_OLU":T!!;ML6P%D"2X#0(X^!WIQ8E^<?+RY
M;_JOL^O9#7IX2QGNQ%Q#JC2D>1?WHX'!W/G:/+U,7/6<?,^6Q<QK*><BLTIZ
MN?B,%M2BYI.*JFA?:]0\)L 0EP=1T@N0>2%OAC/_0^;-U+XE>3-WSO!F2JC)
MF_W,Q)N[H_: ;>B(E^GIV-,,3&,47HLCW+BNP[A(I5@JI_Z7=NK\=R>II*1,
M-H@7LD@3;JR6+(G"J_HX,(7[JH@M0_0"@?5Q*XC"OB!BHLUZ?2YO/?.CZ\N'
MOU@W7O@,-C&L24"$3G[]V<2S4SGD$X>F83AM=)U.L2H("6@S-@>(YKR+(JT9
M$YM[I;US-<"C4D0:O#(DN9NSAWKGD=6\Y0B.NZ;IC7Z'Y-9OA^3FYT5JZP%L
MEOQL$7)J.T45;-$BN'-A_N%*_C"!GZ86S%.'>;=CO ?\&0**JOJ<Z85HBUA[
MTP\KPPS7"JF56^(%1/ML3+?;6V+ZC"K0WF9BFB2Z,O5,'6+>3X$)N$E68=$2
MF?PS/=01!3)-_Y/9V0TQ ;@Z64ZJ$XE9PRDL4W<@)^@P]#6%!-M04&(@H$XJ
MYV_D=H!D!%L :O*$F52,3AW.!,]!9'^C8\V#)C=JX+($Q]VS2(Y2ZA*=GYO(
MKCWJ]CC(#L9#ZCM&92]4AB.>AS>VH"3>"AZA$"-W0EIE[K/YV8<K6;+@J8K-
M4;*-V'*_V5,:%Y5AOY"4"3&L-QR%H%(0"@='B.1!T @3EL1!0H17XG@LQ 96
M,*Q+O9('(A4&IFP$5, <^W&OFH#A@#E= _Q&TQ)GWV?1W)S]^?.\J8HPSP+A
M9@ G(UM:?H]2B%8AV/5O^D]PTID=QN@>.\^'2,8@8%]SA7 IX1E%9<W<:-=J
M +/P. ++"L$LKI/=7<&U1E%=B]T,?+]1KK#O 3EV]X<(M]S,+#BPXZBPKCT5
M?BG9W,JHJ!4<4"+0QZ"]/'8YGS6+":V<0!\&L5423Q(<OQ88(\)-.6)H;'WY
M8,^85,#(0 .QIVGL'4)=]+U_Z +JPQP#RM$JSK%Y:,(\%CV_9X<:WD)M@IH0
M+A$]&/_%Z^BZI@VA&M [U-IBNEJLW4Z'=@R'AF)=X"XA_NVG=V2Z%!'"!^!?
end
Responsible-Changed-From-To: gnats-admin->tlyu
Responsible-Changed-By: tlyu
Responsible-Changed-When: Fri Sep 28 22:22:08 2001
Responsible-Changed-Why:
refiled
State-Changed-From-To: open-analyzed
State-Changed-By: tlyu
State-Changed-When: Fri Sep 28 22:22:15 2001
State-Changed-Why:
Ok... this is going to take us some work. The option parsing is
clearly borken, and for quite some time. A general audit or outright
rewrite of the gssapi library may be called for at this point,
unfortunately.
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id EAA17441 for <bugs@RT-11.MIT.EDU>; Tue, 10 Aug 1999 04:49:19 -0400
Received: from quince.ifs.umich.edu by MIT.EDU with SMTP
id AA24669; Tue, 10 Aug 99 04:49:30 EDT
Received: (from mdw@localhost) by quince.ifs.umich.edu (8.6.13/8.6.12) id EAA13573; Tue, 10 Aug 1999 04:49:17 -0400
Message-Id: <199908100849.EAA13573@quince.ifs.umich.edu>
Date: Tue, 10 Aug 1999 04:49:17 -0400
From: mdw@umich.edu
Reply-To: mdw@umich.edu
To: krb5-bugs@MIT.EDU
Cc: mdw@umich.edu
Subject: patch to fix kadmind hang and other stuff
X-Send-Pr-Version: 3.99
Show quoted text
>Number: 738
>Category: krb5-libs
>Synopsis: bad or malicious client can hang kadmind.
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: tlyu
>State: analyzed
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Tue Aug 10 04:50:02 EDT 1999
>Last-Modified: Fri Sep 28 22:23:28 EDT 2001
>Originator: Marcus D Watts
>Organization:
University of Michigan>Category: krb5-libs
>Synopsis: bad or malicious client can hang kadmind.
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: tlyu
>State: analyzed
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Tue Aug 10 04:50:02 EDT 1999
>Last-Modified: Fri Sep 28 22:23:28 EDT 2001
>Originator: Marcus D Watts
>Organization:
ITD PD&D Umich Systetms Gruop
Show quoted text
>Release: krb5-current-19990201
>Environment:
System: SunOS pepper-pot 5.6 Generic_105181-03 sun4u sparc SUNW,Ultra-5_10>Environment:
Architecture: sun4
Show quoted text
>Description:
Denial of Service AttackMalicious (or confused) users can hang kadmind by
sending bogus network data.
Show quoted text
>How-To-Repeat:
Write special program (not included) to send bad option ingssapi network data. Kadmind on target system will
go into an infinite CPU loop, and not respond to any
more requests.
Show quoted text
>Fix:
begin 644 patches2.tgzM'XL( ';DKS< ^P\:W/;1I+Y2OZ*<;+ED"(I >!35*1$EF1'%5OR27(E6WM;
M* @<4EB1 . DK6)[[=?/P; X$%*\L:I7-5QLR:)Z>[I]_3T#'5Q<GC\[F1[
MZ<3NC8RVK:^^P,LP#6/0ZWT%_YI&OPOO\#(M?C>,X< ROS(&PWYW.##[!HZ;
MW;XU_,KX$LP47ZLH=D*8<C&YWP@'8-/IAG$E##)O@K1_+)-?[G5^)\,[3]Z/
MZU<W7B3@/T?\NO+<6Q')6 13,?&FTTA<R_A>2E\L'H0;3*1P_(FX#:_['7<5
MAM*/.^;N[JYA&>9V_3064^^CC,0B"*6(;QQ?_ N4#)^D^!J^S;X6RS"XGLO%
MMA"GXL:YD\(/8#STY$3$0=U9+N</ Z\Q &AW3F^-Y\[U3.*($0XQW^@&>NA
M=&%8@%R1%_@HPJT,KV481&UB&P@"7POG 8024;" SYX/-*Y7L;@)EG*ZFL\?
MZL'UG1>L(C&;4V"@'+'P)7&(B"CB!#Y,64@I0AFMYK&X!T:!E <?@6:X\K?K
MH%DI5( )SW?GJPF@$A>38%RO 2F!>@&T&8R+6V<"'$VV1<-Q7;F,[4BZMAOX
ML?P8;[MB[OE I[?;;S6WZ[7&M3>3_J2)%"8P-!.=#JM31C%,$\&$4G@Q3"4C
M_]NX7JM%4B[$+(J<I2<<-UXY(*]8122D%P'->1!'J#<7N9)DA6BU7 9A+*3O
MA@_+&!4;/< $"P!$A;*=)Y!!!/[;A6GFP<QS12/CI=D6H3L J8 DB>-/9-C.
M!ETGBOL=TQH!<B.<NL(R>[UT' B?!3'K&K G'C+AS 5/ RQ*WP&G0OG0IL ^
M20,NYB-.$#ZTP3CQ30!F1E\A /0#WYO"#%$;,/$!TR,S(I.>OY)D<C#IA/PG
M404Y-4I<K[_VYD73CNMI2@43@P=$F0\X8/D&10>X"&!&315ESLSQ_ ALM":T
MU$20B*0+.@$/>0O.(/S5 OR;Z8* D4R$"T)OYJ&2IH"WW:S7Y][U#EM^![Q&
MAIZKOKZWU??MFWJM;[;0!$7/ L^HO4.NO04JP/'C.>A4Q;KC0H!!.'&@P.08
M7AC;@%2+'OS8B3V7/,T!,/@F%R!;A!H EU\$H$NPOXP0'"#DQR4$% 9P! X#
M9NA <( L,_!Y30C4TTY5E( 0/11BX2QUGXT?EL"^#_8$0[BWT6I!CT RRS(0
M?B)!6^@F9!&)^M?QT?XY3.87GLZE/XMO,'HP,G.4OE[YMWYP[W\M J(28?Y;
MRA"R#"!O;8FK'T\O!?SW\X^'5^+H\$S\>'CV1OP$"_/IV;'8VJK7!KNC)W#'
M#)75 _D\E+8;@L> 8BQC%VE%F'<IF. Y$/* =(%66=6)L^ 7]!1F"RP%BP@D
MTS@(G1GD1LS(0+FH>.65V83UFMD?D& N^.C*=QDV$%5F*QH-D >D:6<R@= *
MG86,)2T%MS,[@;0QA_ER;E]#1@7WB01,A6H'L*43124_,$=$LS$-P/OFS9(&
M/-\KN5K7)-_A=(D,S -P=8'Y]5JZ#J36@CJ( 7)%3,F"O$,\R!CF[UID'8HY
MJ7)KR<2U[F"@067.D$H3>?^6Y(S&$ %G,BZH/H)%XCX-UG*,1,P5DC!)(XDD
MZ;J0$Q1<U**97 <EPOGTN6BQ2RB4YTJ4H'0PZ(_^4Z:AFOS#3#(TS,=-4O23
MVWX$P<KQ1IR$L#3 <H%K/"\Q$02R"S'4&W)HIR-@7J.+SVZE7$)9Y$ QAEK'
M"0.>CA<B9>.N2?RA3 HF'6&;5(WT>N59^UVVX-Q=S2%!<W&T=MH"\G"01Z;U
M[:G(NXR<\9B,],Q!B<^>\K0*Z)Y9AN[W-6AG/H-%,;Y9),LX (QZ:\CE"?59
MS66XLNE7_I.-/RHS/"PI@\I6=$Z589GD-"ZS.*B6-5Y-IS#,N:4X#'4Q&:B]
MP4+]"G^I4EE_5,G!4Z88F.5 J%4[$ ]3IOA,B40CJ1*A- XE%283+YI!38=%
M1LFFJ]B;VY1:R:IDM4W+# S[\CY;EL;%M:N7QBS"Y08SK'IMU'T*6#6WJ!2]
M$KJ5XM^P#1+>G81=A!/.((\U(BB(H;"5<P_V' [5UQZ67UA284[$M1R*7,H%
M$^<!MQRU!CG?&B7![H+*C&Z:PR%7*IDY;E$(JA$\_\Z9>["1A&*1)&J ?R]Q
M<X!;H]5B65'LJ3E^]=D2W4*M=>>$'FX#R.B37$62KI* 4$S?VVD:KJJKR(%
MC^1K:V:@$-M^A (O2ILI_,G[_R_:^%&OC?T?T^S39^K_] >6V<<6BM4?FO_?
Show quoted text
M__D37J>P"?\X%NMW@_O_^:M^<71)6]"QV'&FT<YJX;DWVW*RVIF%P6JYX\63
M'=I?[X 1*,RWW;N(XST*W9VG[%K;=_508@OI#GL@(;Q1]\?<QO^-ZAB5HK,2MG5 ]$65).YU.^6D-=]\[AK5CF,(8C8WNN&?6$JJM5FL3AB6,P=@PQE:W_L,/
MHM,WVSU#M."M/Q __% 7\()LBYN2K9VZJ(MO)G**^_FKGR].KT[LT[.KQC(.
MV[B_;XMD-_[?]0[@X4#S'\8_Q;YHP-H3-D4CV:]_WV@ 0O/@P.HUQ_SYI?%Q
M.FTV]W+(YAIDA6T.%-HX?32J)F1M)C0JT4E)%PAU-XB3TDAERR.+UK[H[=5;
M^#WM7'PO&@##SS2%07GFS7R)6WF82B?9SH.;&\!!B"*XM0%\5(+N5D$C,-JX
M56N*L6@\SCPA/(/M,A^;N*X0LI)M384:0FJ7:N<V!_\7W!L%L#[+L<1ZG5=9
M2#S;^.+)UM=9J3"0E3/0Q<GA\>;D@[1PDI2W[[[+5&SUQL( .7Y7T.DKY4^'
M-@=C,=H ;>6@Q6B,+KD6NIN'AM2+'KD^42A!& &MJDD$J#1/:XT,P,C:<>0:
MQ%H[CGR2DGAXG)L8!C9.O(FP]0AC71;LT2!-?&!3C/[Q7K A\C99Z@LJ^M%@
Show quoted text
MX6QV>77!>HKPG[GT$R4MY,)=/C#--J<CL=7$C0Y]1\BRT/18"?X4 H4,D))H
MEDVZEE$BB-9$"ALYRD$^;6I6TJL/KWGNZ]6TZ$Q:R9.("E#-;6ZKXS<&3UG3M%)]#@!WE2N:Q%>-/GB(1Z3E3H+@[6UMBX<SG@2ON0V>YE&&TAUW&B$\;TZ.V
M24"[:2K]!/;*0J[_5"F^_DSCKU6*K^7SV:5XI;!8C5<-5!3DO5Q!OAEI($P+
M,,:] =?DO?8 2O)>NVMP2;XE_G8Z^1M^0).T4$CN^U +@[^# OB9C0]M+VI(
M_-#D1$(@JN<A: #\[S<>X[:? A?P\!MO*CA*)HV?+E[U[:/#RRO[\L/[]^<7
M5Y"=?L^/7AP-TD&FB(=FXN3LZ.KO[T\8^>C5D7WYX^&X8AS1L^$:6&D5^N+H
MI\L/[VC\[!0G__$0&/X&0L&;5C!X?'+9S3'X(C=\=HX0&I- !$";>"/1K.
M^--8\%,2>?K51(C&N^-^E0J2X:.+(VV*LBHN+@^1A*8))/6)WQ2T :/P!!(=
M*,G@%"!^@9>@NQ3WWD3Z.[X3AL$]=W?PA.)Z+K'C M$6M>G.@1<+/)&/^&(!
Show quoted text
M>:5E&>B65J_7'B4[17*KB1,[(G)#;-KLT6/RQ5!.;&]B\YF+K0XJ]L79A[=O
M]S+D/.A$SN6,OJ>0K00R=7CAWBH'+CKVK?K ]#T_!O;AF<WY,'L*DQ(>7L?(MGC(N/$!I>X:)TO:L87N82(NOA?.O(+3QK'@5 8]O+L'L]NO#T[<?+D[V4JA9
M 'J;.MZ<'[&%$NX +?;<6QEW#N")O73">#MC/%.-LXIO,%O +C[&SWC<Y#IQ
M$#94"FF+!(2_O<2O8(TFDB$A3,HDO9[9-KLD1:V*.:%Y$SA-XP5U0#.%-UCA
MP/>:3)-(!JN^^"VM7#:K*H&BFSO[X+8U]E.^SY*M1=<R5HM1JZS<%BN7W@$=
M[.E-'[*SN+0U[5'_-I1NK+H:2E+=$<0^E%&&8: (B1U59;<O3.45E@GNT.KU
M^WFO@+F!%*E'W)G9'&H,=!#=<!/;#^[;U/FE-78;09-*%!E2VF"'SSKY[,"9
MW4LIH9UJYQE4V*QM\ I\B9>+29_*)%1 [7%?+_@2Z:=KM,T>*&C0P_>\AIYE
M'<:I=VKB2@=5-Z2DQP>>'Z%^@>+%ZHGKAQB/5CQ?W-] ]4#Y%;'](+W@@#=1
MHJ5TO:DG)VV\Y#$+)54Z=$]H'9'6DUA@W;5&:VD\G9'-I$#M@4^7=/BR3A7-
M;7'$UW3P+@S=N?&!18IJPN?^/ZB=5B^TZ^OS"UA]3HXO[?/W5Z?G9Z*!3B^:
MVZDQ<I9!)VNH;-,Y2%23?:+,(%[L:X[ZTQM8XG!M1JM :5Z!S?XIOA.X&<1$
M\BA@(]%5,_/:-*%L<.)7L.MX=7IV?'KVYG*-)P][&.E]8Z0B'6#0'J#X25(;
MY[21Q-R&\[<L\CQ_N8II/!UL@U[H]3*4OQ)^NAU1RJ@>3<*X^4C<;A8Y$>43
M"[_;;_=V07IKM]VW6'Q*$5@77,LYE ZH /6:2)3=!L;LA80R?):H/\UL$/S>
M-!_SRH0'8.NVNOWH:.Z,-V'"P 5R>N;?1"?QA,>I"2WC;O N9$U?SCR0:CUT
M1_-%$KWV!!2KEZV#$.)SV? .>/UA_-PSBH92#X1%A.HI]98]A@1=O7CQ0D!>
Show quoted text
M2>*=ZK3S#U>7I\<G@F\5!LMV<CV.L>"E+H:ERIL$>/>$KZ>L2)=X?X56KDTL
MI5O8E"TEE'BN&'09%Z9%!@#8:JO[HVH>$@LKVS" <H$2#]2:J3AT"9!OD@(RM7O2[#D#Y<]HPTU%\R!_9,Q(.U:8HY:M@@;1EP0SE1$Y8U_E375_Q^O ".R6(
ME5,(;0?69N-QO8/9X3G*3A ^6W^,_DP%MMCK._MYOD2+NILUE2L]R-P&[M+R
M0-3Z^BTU7+DR3"80C]8F*9A>*]8HOXF<)@MVS-17>Y(%B6:5JXA,_7B4SA>[
M:'?CX 5H[7IC(M1C'I!0U.J[<&*#^FV:P(::DC9.VBKSDEE*5Q;22"/EPM8V
M9DWQ?0[JI;83&]-.C):7U"D>T7\&IQF 'W[*C/,DY:1R;_(J\9F*48OJ!J4D
M$&L4TJH]7B@S3-$31<X;<4\UG3NS2/S.^$?V\<G;DS?VZ[>';_9H?Q'$PDFT
MA.E<CX;/0T\FOX;J\U9C2WW7?'@BI\YJ'H]INY(\+"X4L.+B2@$5K S#(,PQ
M6*"A/W\"&2U1?B*OH8AC9I)GM%;JVZE/JEQ(IBM@MG2P%#FQBN+-I;J<*X[X
M(_:G5V[,][=BV+9CTY)^W@!ED4<JQ>II,-K%TG%H#=H#?0OTB:D+.8=(_VW#
MWK&3CJG4 G-W#J+5]:U\H)Y!TJE+P-;WFC9"4+N).-X=M4UDN=MK=T=IHX"F
MY5*6KM/MB]&>-H+7"9WY3*NUE>-TN/6TOLNVCJMNQC@9-FN8E( N#G]6'ENE
MG+48&O?>S&?NNWOKQ#4'U?*:>7F%UA1,!=9[IEFS8T-C] FRI!A%Z5-9OHV^
MU0=RTEB]'$XJS;=N@I,D@BIYM"YOM3B%/N[CTB0(GR5,UUHC3+A&F,3GDC24
MVRR2A+A#4KR5-TAINL@U6E2G3,E6':=935-: M;.7H+7<HB>.##_8.8I7#R?
MR,@-O24L?[3AR9_AY'YX\9<\O=$YW'AN,RR=VPQ%04 ^L=$?;3BK&:JSFFKP
MY.94U^1^N+%+_7!C-^L0X#&DNU@VTB-1*CRVZ9<H8>< "\E_F/^D@I+:;@+V
MI5"+=P[PMN^"GC>Q#VDDFWG$[QS$L]B6'Y? %'@+DXP]V&MO@VOC!W(8!I4J
MR!@*'/%Z'KBW6G^YAFYE*\0TEVW1SPVS$H8S>M9*(8'-(0ELCG+-ST]U+2!R
MM/>YH/_3Q"CP0^W/:2C9DMPF]V.]#"3J4.WK 5+X-=%?,$#R''[V'4,EH'[!
MD!]5!,B@\G9A$7P@S.[8W!T;'"!05("[P+^[B;=@1>4Z+B2K!OYDJ<DM"55V
M<;>:A_E-.R8B/XF=Q5)D3K27M/UQ;XB_TTQ^/M'I3 )Q"B4:9D?^>>R-%WTO
M.J!?\5I>(\-)"5AY,%J'*JUT.A5*MRVVRH=6>P)S,F+B6JE*1#N#BS\J; @%
M5(O9Q[JP9?9WU3D:']+?R/E2AND/SB!Q5QWVKCF!$>\OSJ_.<>UH-'2)FDV2
MYOR=O?+\N&MA>W(F8QLXI9T,Q)&&F8'ETD%;<*HJ'.MMX4><@(0:X(E(RQP:
M2BCF @MXF[+(QM\EB/15E$/%JDACEG@HX.,9XW5ZC)'Y4M(CW.*&J=K@<J[R
MX[2[NJ<V>86!MOZX\@2R24VM*E'Q=PWX@P#;A^D?DRECG(:39 >^)A_:K-U1
MGUQFUVR;IO*9=;,"U6FPPE\Q/ZY,KG*JIA6YJWIB"Z^5D"^U5&V/>H(I55L5
ML1^7LY5H,_-B/ #%:D5LL2^EU5I=J!E46<-UWY-4J:?_@E1TS-LL9/R*7T_^
M!;-^F<MGET85@F+V+S^N6 &&N1)I$PJO L-QWR+?[9H&.FV+WODL@8K8B'Y\
Show quoted text
M773C>H><V%G2<<*=J1U6QA_;5 ZTQ:W-[_GS$[&0[@TEQ#8?^S?KK8W$Z"A6
MI[A\ DDM&^1];Z^>]VPM[V_!YSWM'DZVF $+);S<O8D];F?PA%BM@"/;/- JM#JB1I:*X+E/J$FJ@YZ?'F;C:<XC\J0QM=96"LWW7VFV;D)"Z7:-M]=-:L) S
M$I70/8PYXF:2\C*#EQNH;;57<4OIMG G0K =DVZLH<BEJPH^+PV"/A;13'^L
M9LJVHUK!J=BHV-EE-QRR>SDG9[^<GJ?-Z:GW<2%?4%E13[9G_/<9<N=5K$ZN
Show quoted text
M>5(X-U@L5ZK/=(-7!9(?I;/Y1/H[\>STZOEGC@77QM/^-FXTFIG0SR*(Z;QP
M@@E/B"Q^,.C?QR^,-+/5G_5*3#13J^>OPD10O& P:W=3M)CN'.0NQ+"O#@;4MV^H.Z5WKQV73_KJ">"3E\K8<*64MU9?[XG]*/=6T)YGW/]69UIHMZP!&HH5G
MEMOIW:1:VAEDPM3/5O[+0"UK) ZX6T G0/:[PU^R[D(9'F: C*M/4XDNE)EH
MJX1,KMLJ 66T2TT% -VM@__;)Q<7]NO3D[?']M7Y^=OSLS=-U3]1#>Y-:AJU
M\CP_HK6B/"U11 <]LH4U=6ZTT5/MD\B3!"W^ZI\NUF*'V$D"&X]'@V+04_K!
M0S6^64;;Z![LII-+6<]2?\('56(F!V^2@X)0W)EM0=N?Y.\"30*^>82GXM^G
MG6\]W'%'H/T] RVD>)G%<*!#=5XSN2[FV*$QM0MOIUDU75 IN]2HC^7.I>.O
MEEIW,4M_H$:QN*7L+@3WSZC)SAE?_PM'JP@^\J]_XS!X@"_930RFH()V7QR^
MQ[.S2_O#Y8E]^>'53R=_5S<[S#X6(JU>UTH*DEH.]?<,]]V'JP^';^V+D__Z
M<'IQ<IPFI5RR1.,I J U_ -"$]URI;248U3M2HCJRYPK9G7.2]8#*W,=<"-9
M_ILY!%'0?GJTD9V\P5H,MJ7?F*L;H=,P6'#KA<W EP^3PQ7=YBB_K;H[^59.
M"@GZ26V2P>+]1WWM+Q#-I"D1;E41SL/KQ%.!>3%>+4EF*F;8=^@ Q**8'*1W
M6S,/?YFY/^LSWY=--T1)'7#Z[8+^U%6T O6>@F_[N0C<UF[._"<QJ'%8",(T
M!E^R2BJX)I%[U+X<#-(+3K6JAG/63_ND;\XR =1/3'F1#Y8/=N!-&OGV@59%
MLS;I 88R<_8B.3(].G_W_NW)U4E3M4H&?6HA#8:C)%+UF9-E.KW!B;L?_1)G
M+3E<X[,UBY*?RIJU?-*TVOF,Z>'97LA% <)^D7199:GD9%0_*TC47N CM[FQ
M\IL;S3_R>Z:JFV="@]9MQ5N>9FJ-81^BHS4TS%*0_&][U][4UG'%^R_^%!MG
MP!+W"NOJQ94PSKA8N)[&D!JG3<=E&$"0:(H1 3E#FM+/WCV/?>]]2#@9VEB)
M;6GO[MY]G;-GS_F=LSROQ+J;1A6K;9W>5&3*=EO8'^^P9G').OWQIZSR'&A-
M$O/<>PZ86 EHG T]NSL[1WO[NZ^_'J.G@OL0G[W;W?]V[R5B)5'Q9K*\.AJ_
M^>;=WV6V%SM_&LOE O,"$X+66\G$NGUMO14QLYDRX(K <-8V3UPS+DQ3E:%6
MU+#5%OM<%+[ F!)%I34Q8N<5@46QNU4R-MK:&PY.%@Q.#9NOWZV(O;>Z6Q&3
M;]@M8RB-=JS3\TM&;+]B ?.OW[/0]%O=L=#ZNW"_M TXTJ_KXG[!3+I68*&]
M9R(8]SO-36I9>_FM!?4I3N@9;$'@A<BB,O6&(@QBTG?[;T7[]KSM_A<ZYNFX
M7@]0;ZG:5JJM[ ;:RJ[0G0(=I?H1T4SF*ZH.T$QZ&0=/.T/1WASU-T>9,MN2
MU58Y,:V+;\9O=_??OGFQMS,6^[L4^/!@?_?=WUZ\'6]HISLY:<IU].7XC]^^
M.CH8RY/!U_NO7N^([.DZZ7V>KF.-.U(.NIY^_\-<-'::0K8$L/PXN[L?+R<W
MWV$822EQ[.U@_>RL0\?"H3*7<?@-#N I'KM6M\>://W6P ,N\^QF/IG.-GYX
M;HMN!8I7VB.OKJ<_'9'3E)27*M7MJ&!I=Z'AW;84TES','W^Q;^-HQ68*.2Q
Show quoted text
M>KN=BKD\U,JOJ:4@]+6(J5B_FE]7.H)!Q=-3K&MZ"@S"))^X/V_.?L27);;L
M#I*@% &/+RCJY]GU_'@*3A.7$*7O$J)2:4-BU(YHN]TX9A$C;( ]"(0\A2!AM%@&E7(^^$^9OH(;3UAQD>DYE3:U[I%!N5DNHAN?@E$^]!2]U' 62R'1BOA4%
MN]'QR-)5LBH_0^^>;D=.M1(T> ;!J4TV3(';HR(@SWM%SR1;1 "NDL\!'<BA
MCB'F%YESL']R*G(6)$TK&OR6Q&Y.DC?7&O_9)&1V6*];Y\VQ/((>8SA@94G#
M1W04J'H3)]*K5.:6S*V^KPJ310U2%!EHWM36GGIXK)Y3ZO=,J#A\#=;A-\4,
M0/19+S%;9<(UL<]YC>*#A%9(O!+C/]>8!V$] /5R2Q[GC3FYDVV3+Z?6]++Z
M<+RW_V;\IJE,"N!HF71[RK,.,P/@7"XLY4O")DYJ]P]GQW)J:G5<BN8(\I8%
M<9.F<:A16\DXA'5J0FIO;&3BX/6KO:,77[^RR*>'WIC=0<<@(JB/%.X&XKQL
MV:E=-_6NA.6? XYH?MZ0#%_R]/2QV@9'@F6B[=5;P8*5_/J/R\>I>I*J=-?\
M2EWI;6STQ>[TXL+A _TNF?0V>^K 0;FOCDGQ>75Q/#74#$(.K!9@H'"B(O@L
M1',GV*RGC^&ZP,0HC]= >)@!]*EDS2<MU+V\)<6:S$<A(5"=5.'?>@80+27A
M;57YR=I.L,6F(L6N[X+MHY[7IM4%X=*5MI]@K(])GR-$.JYYVU&O\K+\:J\5
M=B:M+:>V;"VU0GE@MU<GZ>J$MBGYG5](WT!:6)W JGV4V),A?TH"M7]B<?FO
M\FU-O+8VW:T6)090$+BYS!R3+"%S4,Y5:I\UPSH#/FC9LH>N/]EV9)+E"!FK
MHN%0O A^,3O"KS,>LEL:*1:'3'Y;WC*LT//^IB8_LXH5KF?YB2]IM3_P6UAW
M\6[_S]37-P>O+/BZMWT@\]B*/Y0,AK<+L.;EX)^?*<0Z2!@<F :K4#MQRH()
M1TBQ-^NFI< 56C#(00AX.3X0IY9<0,9!8'!2:&HU[%I6<QK%"W3T!7-<'0$.
MQ9Q0@%NA5]!B<E]#*P_D"D<5B[V^.9N[O7:$DA0:CG_%=7/ NJ$P=/SR["?)
MZ]'.PKR9G>#7UL07BIOCZ9^'! O:<1V67N'>$AGI@X+-%F0G\!]X[?;JEQ>\
MUO5D$P/@#D.F8%OCM<E]41%/EN!:>'H'GSFXLH$\7T<"VDI^V]"XIZOM_-;^
M0ZU59/@HP2;*?QL-.&:L-ZG)[]N'85H62>M$TKJ'34?9X5GVN>'.2DQQ^E)!
MQ[RK&9J$FH(;A[I7[Q%XS=E24=9KLA(UEC$B1S591ZW$2DMK"@VFOFCUC+@%
M\VA#32BR@.% RE%);Y"Q.+5BH+_VXL;S$$']6%FIN(1LF",NEG.*Q"\;Z50%
MKUG!9LE]N:(9-.["%MMKO3PHI\E1KWP/;6(PDD_9.(K@U%Z>F1.>:/PT Z]&
M?CN:J*$)>45OZ8,]+J\E[.Z"]#@2QR=PA8IU&\.763U*!#-_0P=PL[L@1KI%
M,I]JKT5N*LFC5I.<Q9,[\627;/D4 ",S<4$)E:W=\DHS^$F]23]VY4T"C_+H
M&>80EP=3CH:R23$2,N,!$=(JI%+*G'^Y<BK0Y"*DL/))Z,#B,=B5'H;[Z0,V
MH!]S;HBO7O0;;G52D9N7+$<MGV+)=^HO>4<Z>$BK.ZI$^A47LFC#_[0&^HBR
M[G<M_Q9VP%0G9!9:4?QIC\SW+D7UPN]/;IZ,2'.+8J7ANR#HH?YP<G8EQ^%&
MS$B^^B=>2P2"Q#%XYLLEVP)%%R0KKISWTDY7-FV0IWW-EKWCGK7&E0NL0U9\
M$-A0Z"):M$F859%46, [2!E7-*)O-WL3C60H%%LT1Z>+Y_Z!2\'86)0UD\65
M^<>XM)UB3:W(\4X/Q#UH2@FZSAY9B[KHT&6=._7P&;((GGE$%GF>53SO5#R/
MT5^E9"C7@0VI;WP/JK&CLQ\_'E\T4#\&JA(T@"/MS2X@"K&-P<?#N6J$\ILG
M@9*773!*L20(KZMBX"Q2#N?"2):T2L/!*=ZC6#DO[K&D>%#/K#NZZ%:^\F7T
MO[!\C!^WJPPR6_&69D5NA;;&1:<E<IY%RZG,"A-7ISPQEZ"*A>?,5;5P1?![
M=GXNV9-61=D*%AV"A?A2@<ZI-F\N8&K+L.G%^W\^I4L,X78J6JRE:[5PH9:N
MTM(E6KH^RQ>G?]97YG^Z[0#C]PWLJ(ZNY4LY;3EA BT>:7MVN8Q23*80PFXZ
MN_RJ/0*M?2K6Z4X8F^$)->$XA3Y;$^[$6GF<C79N]OM0"+CSH 'ZWJ<'"0Y0
MK5O8C=7J& $$U,\2B$#.$ $O*X$$!J/^<-1YZ" !!$3VVZSR*,,'F$?/)->8
M7?],.(#E0 /<9@Q#3&"% 7H @:*@VW.L_N3:0RN?5J3Q*Y53+(\_E K[P]'<
M6 Y$I7G?L^,CHXV9]0WAUM(_L^J./9WT@=IX$859*."5K?2\,YKDQ$("RTF<
MSW\F,/"<[S)V(052,(CA"2JP!(RW!!" 8S^R5/6^2S_C#!RVX<"3FL8ZL1@6
M(=*6A0 (Q(35S8IPUB(;(5R@9:Y/,RS9 ,3 2MH^!*4(?,LP[#ZO+@T%8_LJ
MY^ERGD4V1<4N[FM,/3B^G,K%0'*@,:?VLP&J4;I#Y=VKMIV&BVK#> IK:U(^
M50=2.<)9DX"B_ G+9%BF9<I\L2VZ:N/Q$J&FI+"F)]=/L"ZWF#SO5A8\+2QH
MAS&*!:%PMCF&T[T<[XYWWKW^ZQ@H>KRG"!#'LH.#F/3[@[2CT4CJC&[+DD>T
M_A#TZ<@)[D$^"8MTVIJ,K")DQW4"-M$ *)+4D$/S@E-XP0K2KJY_5=(,NM;I
ME 0M3FX.T(,%[;V.5B</3T%]V:#EY[%J5/RL!A?5XJP!JYS,)C^3]4JK\@SV
MI"BKI\93.)/EJ%37X1I%+5,IDJS.IJVAK@[:''8L[D1 !7W+X8V#6:!(J+8]
M*(4!A'8K54Z_UP,-8]+/\S0;&JVIO_8)'*-@QP7L&DT>BX_1"!H:-5ZY(^<,
MUZ/$'J]PF"*6)GZ+MU$8<Q,9EARE+XF]KOK6A+^-*'P+"]# A:KHHHVQ>J!Y
M^=INFLKXZ?<!U=3VP[#5,:4TEB#2X+[PL24G:6O0[:6]OH%'%1ESU#7R'(V7
M9%-1#JM!1R_ESLCWV=.YVL ZV!EU!PO"9@)Z: 0.5,EQHB*'O\*0*+?(XS'
M\-T%@3QFI=@(>O4 58?>@T\/[O$Q/2L:L--@" 8F,/:B:6_UR.Q"+=0V&]%G
MIW.Y95A@2%9&:C2D!2&2-2EIZ0M"_)V?HR.!R[X*282VBGJB_3(3ZT&/@OVA
M''ED[Q@QX)&P+"UB"5,+?1;AA:9(#E((Z/0Q'Z&>I5#"WL:JD@_RD'9\>CJ[
MGN"..<-(^SK<)X5%&PQ[P*.-Z;"^X5NQ_7N(/($Q< 'K-Y+;R13T_Y/I\248
MEF$@%%<8F?;]]I;"I-027K_EO[$I<= ?PO$CV>P-TN& I;PBV<*( 2VG$;!@
M/EQY5K54N!IC7T-<7=;7&X?FO%K6O&ICWJ>SY2W+MU[XYCQ%%-4&O(@YZ<$9
M8*K,=VH?M6QXC@G/]<6NM.:9;;G$HK>D06\9>UZI.:_JW&H?#XAIH$ZO&8V&
MJ4\(!5Y]]UNEQD+(AL'XZJRR"D9&PEN6T1Q998Y.90YW<2HVAF*-4M6![DJ1
M<PBJ4,Q+;?8KODDQUY9$AMG:JA?A^G-Z14'#HQCKLD9(_W66?BAX'ZJ'_ )W
M7M]C"B+AZ8B$JR;BTX7],M85F:YQNJ4QLK,2>"K6D^OB-Y#Z*/8*K41R,L=>
MHGO_&UEQBR373V+)+7N=;3C%0%[+6$W]G=>GX@H2KJ#?FL2[G QROUT:Y'>X
MMB<073NW]_EC#[=&O#F2$ R/XV@@Q\G.8*:@(E=6*U>G5JYNK5R]6KGZM7(-
M:N7:K)4KKY5K6&]4:PY^O='/Z@U_5F_\LWH3D/4//>7$/65U5Q+4-W9@/)!N
M!^Q)>;YI8+E+GCTB,I@B_;SHS%%0QG0EUV<-LVO3)V( P@YMHH%LV,ULWU#0
MM\_ D/A1"E!P+K?M:DJQ9XG'$+8G &YH$=G%9:1B3:,Y4J/M6:@R#\;A5FFD
MZC6RE#N6L!K":TQRM7$?'^?3BR.>AX>(_+#;MW @6Z=S@/ZP$R+XCZ$3O#:>
Show quoted text
M>2"R-H2)Z X) 9*C';&C(T_%T!1A&.9'K9K!.$^8I/6=4X^2)4OJ"P!Y]90$
MIRV.GKWE%'8#9ZMG)C2VHOP"O 8O9,BO#1TZC+0*YT#>)FG6!B<^-<BJ3BNNM-9^]_D^T^966D-+PLH:W84'_OLU":T!!;ML6P%D"2X#0(X^!WIQ8E^<?+RY
M;_JOL^O9#7IX2QGNQ%Q#JC2D>1?WHX'!W/G:/+U,7/6<?,^6Q<QK*><BLTIZ
MN?B,%M2BYI.*JFA?:]0\)L 0EP=1T@N0>2%OAC/_0^;-U+XE>3-WSO!F2JC)
MF_W,Q)N[H_: ;>B(E^GIV-,,3&,47HLCW+BNP[A(I5@JI_Z7=NK\=R>II*1,
M-H@7LD@3;JR6+(G"J_HX,(7[JH@M0_0"@?5Q*XC"OB!BHLUZ?2YO/?.CZ\N'
MOU@W7O@,-C&L24"$3G[]V<2S4SGD$X>F83AM=)U.L2H("6@S-@>(YKR+(JT9
M$YM[I;US-<"C4D0:O#(DN9NSAWKGD=6\Y0B.NZ;IC7Z'Y-9OA^3FYT5JZP%L
MEOQL$7)J.T45;-$BN'-A_N%*_C"!GZ86S%.'>;=CO ?\&0**JOJ<Z85HBUA[
MTP\KPPS7"JF56^(%1/ML3+?;6V+ZC"K0WF9BFB2Z,O5,'6+>3X$)N$E68=$2
MF?PS/=01!3)-_Y/9V0TQ ;@Z64ZJ$XE9PRDL4W<@)^@P]#6%!-M04&(@H$XJ
MYV_D=H!D!%L :O*$F52,3AW.!,]!9'^C8\V#)C=JX+($Q]VS2(Y2ZA*=GYO(
MKCWJ]CC(#L9#ZCM&92]4AB.>AS>VH"3>"AZA$"-W0EIE[K/YV8<K6;+@J8K-
M4;*-V'*_V5,:%Y5AOY"4"3&L-QR%H%(0"@='B.1!T @3EL1!0H17XG@LQ 96
M,*Q+O9('(A4&IFP$5, <^W&OFH#A@#E= _Q&TQ)GWV?1W)S]^?.\J8HPSP+A
M9@ G(UM:?H]2B%8AV/5O^D]PTID=QN@>.\^'2,8@8%]SA7 IX1E%9<W<:-=J
M +/P. ++"L$LKI/=7<&U1E%=B]T,?+]1KK#O 3EV]X<(M]S,+#BPXZBPKCT5
M?BG9W,JHJ!4<4"+0QZ"]/'8YGS6+":V<0!\&L5423Q(<OQ88(\)-.6)H;'WY
M8,^85,#(0 .QIVGL'4)=]+U_Z +JPQP#RM$JSK%Y:,(\%CV_9X<:WD)M@IH0
M+A$]&/_%Z^BZI@VA&M [U-IBNEJLW4Z'=@R'AF)=X"XA_NVG=V2Z%!'"!^!?
Show quoted text
MT>GQ76'%?:,R7O\>6=UK-Y$C?,;__1[Q?W_X_/G\^?SYW7[^"_K-A1 M
end
Show quoted text
>Audit-Trail:
Responsible-Changed-From-To: gnats-admin->tlyu
Responsible-Changed-By: tlyu
Responsible-Changed-When: Fri Sep 28 22:22:08 2001
Responsible-Changed-Why:
refiled
State-Changed-From-To: open-analyzed
State-Changed-By: tlyu
State-Changed-When: Fri Sep 28 22:22:15 2001
State-Changed-Why:
Ok... this is going to take us some work. The option parsing is
clearly borken, and for quite some time. A general audit or outright
rewrite of the gssapi library may be called for at this point,
unfortunately.
Show quoted text
>Unformatted: