Ticket History #7917: pkinit doesn't deal with token label properly

pkinit_open_session() has logic that assumes the CK_TOKEN_INFO
tinfo.label will contain some white space padding at the end:

for (cp = tinfo.label + sizeof (tinfo.label) - 1;
*cp == '\0' || *cp == ' '; cp--)
*cp = '\0';
pkiDebug("open_session: slotid %d token \"%s\"\n",
(int) slotlist[i], tinfo.label);
if (cctx->token_label == NULL ||
!strcmp((char *) cctx->token_label, (char *) tinfo.label))

There is no guarantee this is the case however as the PKCS11 spec states
this label is an array of characters, padded with white space if
necessary, not a C string. So if the last byte of tinfo.label is a
non-white space character "*cp = '\0';" will never be executed which
means strcmp() will have been passed a bogus arg in tinfo.label.

Properly handle PKCS11 label in PKINIT

The CK_TOKEN_INFO label field is defined to be zero-filled, but it may
not be zero-terminated if all bytes of the field are used. Use only
length-counted operations to process it. Also avoid underrunning the
buffer pointer if the label is empty or contains only whitespace.

(cherry picked from commit f8b42ef541a463f56720ec9358dd07716b04c5e2)

https://github.com/krb5/krb5/commit/acb07eae351434ca1058634270e5a9674ea064c5
Author: Greg Hudson <ghudson@mit.edu>
Committer: Tom Yu <tlyu@mit.edu>
Commit: acb07eae351434ca1058634270e5a9674ea064c5
Branch: krb5-1.12
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 28 ++++++++++++-------
1 files changed, 18 insertions(+), 10 deletions(-)