Check NULL pointer before dereference them
Found by Russ Allbery
This commit is contained in:
@@ -447,7 +447,7 @@ check_tgs_flags(krb5_context context,
|
|||||||
}
|
}
|
||||||
|
|
||||||
if(f.renewable){
|
if(f.renewable){
|
||||||
if(!tgt->flags.renewable){
|
if(!tgt->flags.renewable || tgt->renew_till == NULL){
|
||||||
kdc_log(context, config, 0,
|
kdc_log(context, config, 0,
|
||||||
"Bad request for renewable ticket");
|
"Bad request for renewable ticket");
|
||||||
return KRB5KDC_ERR_BADOPTION;
|
return KRB5KDC_ERR_BADOPTION;
|
||||||
@@ -770,7 +770,9 @@ tgs_make_reply(krb5_context context,
|
|||||||
et.endtime = *et.starttime + life;
|
et.endtime = *et.starttime + life;
|
||||||
}
|
}
|
||||||
if(f.renewable_ok && tgt->flags.renewable &&
|
if(f.renewable_ok && tgt->flags.renewable &&
|
||||||
et.renew_till == NULL && et.endtime < *b->till){
|
et.renew_till == NULL && et.endtime < *b->till &&
|
||||||
|
tgt->renew_till != NULL)
|
||||||
|
{
|
||||||
et.flags.renewable = 1;
|
et.flags.renewable = 1;
|
||||||
ALLOC(et.renew_till);
|
ALLOC(et.renew_till);
|
||||||
*et.renew_till = *b->till;
|
*et.renew_till = *b->till;
|
||||||
|
Reference in New Issue
Block a user