s3-librpc-crypto: avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()

gss_get_name_attribute() can return unintialized pac_display_buffer
and later gss_release_buffer() will crash on attempting to release it.

The fix on MIT krb5 side is in 1.10.1, reported in both Debian and MIT upstream:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658514
http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7087

We need to initialize variables before using gss_get_name_attribute()

Fix bug #8988 (avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()).

diff --git a/source3/librpc/crypto/gse.c b/source3/librpc/crypto/gse.c
index 335dc1c53f149fb08af44e7d753c99149a02d961..02fb0f6141d320fea533247b19feb7626cb34833 100644 (file)
--- a/source3/librpc/crypto/gse.c
+++ b/source3/librpc/crypto/gse.c
@@ -688,8 +688,24 @@ NTSTATUS gse_get_pac_blob(struct gse_context *gse_ctx,
                          TALLOC_CTX *mem_ctx, DATA_BLOB *pac_blob)
 {
        OM_uint32 gss_min, gss_maj;
-       gss_buffer_desc pac_buffer;
-       gss_buffer_desc pac_display_buffer;
+/*
+ * gss_get_name_attribute() in MIT krb5 1.10.0 can return unintialized pac_display_buffer
+ * and later gss_release_buffer() will crash on attempting to release it.
+ *
+ * So always initialize the buffer descriptors.
+ *
+ * See following links for more details:
+ * http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658514
+ * http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7087
+ */
+       gss_buffer_desc pac_buffer = {
+               .value = NULL,
+               .length = 0
+       };
+       gss_buffer_desc pac_display_buffer = {
+               .value = NULL,
+               .length = 0
+       };
        gss_buffer_desc pac_name = {
                .value = discard_const_p(char, "urn:mspac:"),
                .length = sizeof("urn:mspac:") - 1