Red Hat Bugzilla – Bug 829818
avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()
Last modified: 2013-02-21 03:44:49 EST
(Copy of upstream bug https://bugzilla.samba.org/show_bug.cgi?id=8988)
gss_get_name_attribute() can return unintialized pac_display_buffer and later
gss_release_buffer() will crash on attempting to release it.
The fix on MIT krb5 side is in 1.10.1, reported in both Debian and MIT
We need to initialize variables before using gss_get_name_attribute()
Patch for 3.6 is attached in the upstream bug. The problem was introduced with commit 1bb6b841 and
affects all 3.6 releases:
$ git tag --contains 1bb6b841
The problem was that a variable was not initialized correctly. The developer had a newer MIT version which made sure the stuff gets initialized. In 1.1.10 this was not the case so we crashed in the libkrb5 library. Initializing the variable fixed the crash with MIT KRB5 and 1.1.10.
I'm not sure it really makes sense to add test case for that cause it will not happen with newer MIT KRB5 releases.
To reproduce it you need to install samba 3.6.5 or an earlier 3.6.x release and MIT KRB5 1.1.10 to crash it.
It will NOT crash with samba >= 3.6.6 and MIT KRB5 <= 1.1.10
it will NOT crash with samba < 3.6.6 and MIT KRB > 1.1.10
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.