sanon: Fix export/import_cred mismatch

SANON cred export/import never worked correctly as the export function was
producing the wrong form of token, which was leading gss_import_cred() to
allocate more than 64MB of memory to parse the SANON exported credential.  The
recent change to reduce the default `max_alloc` of krb5_storage exposed this.

diff --git a/lib/gssapi/sanon/export_cred.c b/lib/gssapi/sanon/export_cred.c
index 06c2458f7222b294f8429f532c95c63912e5ab9d..359eefd372fcd9ce3f68b72bebda1e5e8b051013 100644 (file)
--- a/lib/gssapi/sanon/export_cred.c
+++ b/lib/gssapi/sanon/export_cred.c
@@ -36,5 +36,43 @@ _gss_sanon_export_cred(OM_uint32 *minor,
                       gss_cred_id_t input_cred,
                       gss_buffer_t token)
 {
-    return _gss_sanon_export_name(minor, (gss_name_t)input_cred, token);
+    gss_buffer_desc buf;
+    krb5_storage *sp;
+    krb5_data data_out, data;
+    OM_uint32 major, junk;
+
+    token->value = NULL;
+    token->length = 0;
+
+    major = _gss_sanon_export_name(minor, (gss_name_t)input_cred, &buf);
+    if (major)
+       return major;
+
+    sp = krb5_storage_emem();
+    if (sp == NULL) {
+       gss_release_buffer(&junk, &buf);
+       *minor = ENOMEM;
+       return GSS_S_FAILURE;
+    }
+
+    major = _gss_mg_store_oid(minor, sp, GSS_SANON_X25519_MECHANISM);
+    if (major) {
+       gss_release_buffer(&junk, &buf);
+       krb5_storage_free(sp);
+       return major;
+    }
+    data_out.length = 0;
+    data_out.data = NULL;
+    data.length = buf.length;
+    data.data = buf.value;
+    *minor = krb5_store_data(sp, data);
+    if (*minor == 0)
+       *minor = krb5_storage_to_data(sp, &data_out);
+    if (*minor == 0) {
+       token->value = data_out.data;
+       token->length = data_out.length;
+    }
+    gss_release_buffer(&junk, &buf);
+    krb5_storage_free(sp);
+    return major;
 }