Do not assume that the open-type payload needs 8-byte alignment.
Align to pointer size instead, which avoids reading the wrong location
on ILP32 layouts.
Select UTCTime versus GeneralizedTime with a helper that only performs
the 2050 comparison when the local time_t range can represent that value.
This avoids ILP32 type-limit problems while preserving GeneralizedTime
output on 64-bit and unsigned 32-bit time_t platforms.
Move the int32 ptr comparison into a helper that first checks
whether the encoded pointer-sized default is representable as int32_t.
This avoids ILP32 type-limit warnings.
Use krb5_time_abs() rather than subtracting time_t values before passing the result to labs(). On signed 32-bit time_t platforms, subtracting far-apart times can overflow before labs() sees the value.
Commit 232c936ea3 added a fallback ENOTSUP
definition. The check itself and the fallback definition rely on
<errno.h> to be included already, so in case it was not (depending on
the platform) then there will be a wrong definition of ENOTSUP.
Instead of rely on <errno.h> to be included before including a
generated header from this tool, include it manually. This way both
the ENOTSUP check and its fallback definition (if ever) will always
work.
Add defensive handling for several NULL allocation and formatting paths reported across issues #820-#829.
Fixes#820, fixes#821, fixes#822, fixes#823, fixes#825, fixes#828
Generate 12 random bytes and encode them with Heimdal base64url, producing
16-character random passwords with 96 bits of entropy.
This avoids punctuation and quoting issues while still raising generated
password entropy substantially from the old roughly 55-bit generator.
Fixes#1145
Do not request an iprop/<master> initial ticket directly. With
name_canon_rules = as-is: this can leave the acquired credential
mismatched with what krb5_sendauth() later asks for. Get a normal TGT
and let sendauth acquire the service ticket.
Fixes#1332.
The function _krb5_usage2arcfour() is only declared if Heimdal is built with
RC4. Put calls to this function behind #ifdef guards so that the build can
succeed.
Roland C. Dowdeswell