From 136c41e4cfc22d54fd4e1a44430a0a01c6232c1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Love=20H=C3=B6rnquist=20=C3=85strand?= <lha@kth.se>
Date: Sat, 29 Nov 2008 19:34:23 +0000
Subject: [PATCH] truncate the number so it will if in a signed 32bit integer,
 apples pkinit uses signed int32 for the pkinit nonce

git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@24053 ec53bebd-3082-4978-b11e-865c3cabbd6b
---
 lib/krb5/init_creds_pw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/krb5/init_creds_pw.c b/lib/krb5/init_creds_pw.c
index 0b75522e9..4cea216da 100644
--- a/lib/krb5/init_creds_pw.c
+++ b/lib/krb5/init_creds_pw.c
@@ -1244,7 +1244,7 @@ init_cred_loop(krb5_context context,
 
     /* Set a new nonce. */
     krb5_generate_random_block (&ctx->nonce, sizeof(ctx->nonce));
-    ctx->nonce &= 0xffffffff;
+    ctx->nonce &= 0x7fffffff;
     /* XXX these just needs to be the same when using Windows PK-INIT */
     ctx->pk_nonce = ctx->nonce;