From 9680ab4bd9f38c67ffeb249cf1572d30a1475d28 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Wed, 18 Apr 2018 14:13:28 -0400
Subject: [PATCH] Fix segfault in finish_dispatch()

dispatch() doesn't necessarily initialize state->active_realm which
led to an explicit NULL dereference in finish_dispatch().

Additionally, fix make_too_big_error() so that it won't subsequently
dereference state->active_realm.

tags: pullup
target_version: 1.16-next
target_version: 1.15-next

(cherry picked from commit c822bacc1b33970a2a20d9eae80f43307e783516)
---
 src/kdc/dispatch.c | 79 ++++++++++++++++++++++++----------------------
 1 file changed, 42 insertions(+), 37 deletions(-)

diff --git a/src/kdc/dispatch.c b/src/kdc/dispatch.c
index 4ecc23481..1f4b70874 100644
--- a/src/kdc/dispatch.c
+++ b/src/kdc/dispatch.c
@@ -35,9 +35,6 @@
 
 static krb5_int32 last_usec = 0, last_os_random = 0;
 
-static krb5_error_code make_too_big_error(kdc_realm_t *kdc_active_realm,
-                                          krb5_data **out);
-
 struct dispatch_state {
     loop_respond_fn respond;
     void *arg;
@@ -47,6 +44,41 @@ struct dispatch_state {
     krb5_context kdc_err_context;
 };
 
+
+static krb5_error_code
+make_too_big_error(krb5_context context, krb5_principal tgsprinc,
+                   krb5_data **out)
+{
+    krb5_error errpkt;
+    krb5_error_code retval;
+    krb5_data *scratch;
+
+    *out = NULL;
+    memset(&errpkt, 0, sizeof(errpkt));
+
+    retval = krb5_us_timeofday(context, &errpkt.stime, &errpkt.susec);
+    if (retval)
+        return retval;
+    errpkt.error = KRB_ERR_RESPONSE_TOO_BIG;
+    errpkt.server = tgsprinc;
+    errpkt.client = NULL;
+    errpkt.text.length = 0;
+    errpkt.text.data = 0;
+    errpkt.e_data.length = 0;
+    errpkt.e_data.data = 0;
+    scratch = malloc(sizeof(*scratch));
+    if (scratch == NULL)
+        return ENOMEM;
+    retval = krb5_mk_error(context, &errpkt, scratch);
+    if (retval) {
+        free(scratch);
+        return retval;
+    }
+
+    *out = scratch;
+    return 0;
+}
+
 static void
 finish_dispatch(struct dispatch_state *state, krb5_error_code code,
                 krb5_data *response)
@@ -54,12 +86,17 @@ finish_dispatch(struct dispatch_state *state, krb5_error_code code,
     loop_respond_fn oldrespond = state->respond;
     void *oldarg = state->arg;
     kdc_realm_t *kdc_active_realm = state->active_realm;
+    krb5_principal tgsprinc = NULL;
+
+    if (kdc_active_realm != NULL)
+        tgsprinc = kdc_active_realm->realm_tgsprinc;
 
     if (state->is_tcp == 0 && response &&
         response->length > (unsigned int)max_dgram_reply_size) {
-        krb5_free_data(kdc_context, response);
+        krb5_free_data(state->kdc_err_context, response);
         response = NULL;
-        code = make_too_big_error(kdc_active_realm, &response);
+        code = make_too_big_error(state->kdc_err_context, tgsprinc,
+                                  &response);
         if (code)
             krb5_klog_syslog(LOG_ERR, "error constructing "
                              "KRB_ERR_RESPONSE_TOO_BIG error: %s",
@@ -201,38 +238,6 @@ dispatch(void *cb, struct sockaddr *local_saddr,
     finish_dispatch_cache(state, retval, response);
 }
 
-static krb5_error_code
-make_too_big_error(kdc_realm_t *kdc_active_realm, krb5_data **out)
-{
-    krb5_error errpkt;
-    krb5_error_code retval;
-    krb5_data *scratch;
-
-    *out = NULL;
-    memset(&errpkt, 0, sizeof(errpkt));
-
-    retval = krb5_us_timeofday(kdc_context, &errpkt.stime, &errpkt.susec);
-    if (retval)
-        return retval;
-    errpkt.error = KRB_ERR_RESPONSE_TOO_BIG;
-    errpkt.server = tgs_server;
-    errpkt.client = NULL;
-    errpkt.text.length = 0;
-    errpkt.text.data = 0;
-    errpkt.e_data.length = 0;
-    errpkt.e_data.data = 0;
-    scratch = malloc(sizeof(*scratch));
-    if (scratch == NULL)
-        return ENOMEM;
-    retval = krb5_mk_error(kdc_context, &errpkt, scratch);
-    if (retval) {
-        free(scratch);
-        return retval;
-    }
-
-    *out = scratch;
-    return 0;
-}
 
 krb5_context get_context(void *handle)
 {