diff options
| author | Cy Schubert <cy@FreeBSD.org> | 2026-06-02 17:57:17 +0000 |
|---|---|---|
| committer | Cy Schubert <cy@FreeBSD.org> | 2026-06-08 13:52:04 +0000 |
| commit | efb5c07f91c5c11fb9bd32227ac74c2d08adf3cf (patch) | |
| tree | c47e7c4f8213e25d1238730077b2ce921b8ea970 | |
| parent | 37e9d3641ba0e0da0d2bbaa26a59ee56a8cf3ee6 (diff) | |
krb5: Fix null dereference in SPNEGO token processing
krb5 1.22.1 erroneously removed a check from get_negTokenResp() for
successful decoding of the mechListMIC field. Restore the check to
prevent a null pointer dereference.
Commit message details obtained from upstream commit.
Obtained from: Upstream commit 4ae75cded
MFC after: 3 days
| -rw-r--r-- | crypto/krb5/src/lib/gssapi/spnego/spnego_mech.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/crypto/krb5/src/lib/gssapi/spnego/spnego_mech.c b/crypto/krb5/src/lib/gssapi/spnego/spnego_mech.c index 4a778364336e..1dd0f170651b 100644 --- a/crypto/krb5/src/lib/gssapi/spnego/spnego_mech.c +++ b/crypto/krb5/src/lib/gssapi/spnego/spnego_mech.c @@ -3517,6 +3517,8 @@ get_negTokenResp(OM_uint32 *minor_status, struct k5input *in, if (k5_der_get_value(&seq, CONTEXT | 0x03, &field)) { *mechListMIC = get_octet_string(&field); + if (*mechListMIC == GSS_C_NO_BUFFER) + return GSS_S_DEFECTIVE_TOKEN; /* Handle Windows 2000 duplicate response token */ if (*responseToken && |