Re: Some memory management problems

[Assar Westerlund <assar@sics.se>]

GOMBAS Gabor <gombasg@inf.elte.hu> writes:
> Till then I found a new bug (using "klist -c
> /tmp/test", where /tmp/test was not a valid credential cache file):
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x400340a1 in unparse_name (context=0x804b250, principal=0xbffffd14,
>     name=0xbfffdbf0, short_flag=0) at principal.c:265
> 265         plen = strlen(princ_realm(principal));
> (gdb) bt
> #0  0x400340a1 in unparse_name (context=0x804b250, principal=0xbffffd14,
>     name=0xbfffdbf0, short_flag=0) at principal.c:265
> #1  0x400341b3 in krb5_unparse_name (context=0x804b250,
>     principal=0xbffffd14, name=0xbfffdbf0) at principal.c:293
> #2  0x804957e in print_tickets (context=0x804b250, ccache=0x804b318,
>     principal=0xbffffd14, do_verbose=0) at klist.c:185
> #3  0x8049941 in display_v5_ccache (cred_cache=0xbffffe44 "/tmp/test",
>     do_test=0, do_verbose=0) at klist.c:497
> #4  0x8049a75 in main (argc=3, argv=0xbffffd14) at klist.c:576
> (gdb) p *principal
> $1 = {name = {name_type = -1073742336, name_string = {len = 3221225025,
>       val = 0xbffffe44}}, realm = 0x0}
> 
> I think there should be some sanity checking and error reporting in
> libkrb5 (or at least in klist). Invalid data read from a file should not
> cause a crash.

You're completely right.  With most of the random files that I try it
with it already fails by saying it doesn't recognize the credentials
cache format version.

But the appended patch might help in your case.

/assar

Index: fcache.c
===================================================================
RCS file: /afs/pdc.kth.se/src/packages/kth-krb/SourceRepository/heimdal/lib/krb5/fcache.c,v
retrieving revision 1.23
diff -u -w -u -w -r1.23 fcache.c
--- fcache.c	2000/02/24 14:46:53	1.23
+++ fcache.c	2000/04/16 04:06:22
@@ -346,10 +346,10 @@
     ret = init_fcc (context, f, &sp, &fd);
     if (ret)
 	return ret;
-    krb5_ret_principal(sp, principal);
+    ret = krb5_ret_principal(sp, principal);
     krb5_storage_free(sp);
     close(fd);
-    return 0;
+    return ret;
 }
 
 static krb5_error_code