From e37e888e9ecdc23a004eb19d72c64c02c5af3249 Mon Sep 17 00:00:00 2001
From: root <root@rshg054.dnsready.net>
Date: Sat, 10 Dec 2011 23:14:51 +0000
Subject: Sat Dec 10 23:14:51 UTC 2011

---
 core/krb5/PKGBUILD                  | 17 +++++++++++-----
 core/krb5/krb5-1.9.1-2011-007.patch | 40 +++++++++++++++++++++++++++++++++++++
 2 files changed, 52 insertions(+), 5 deletions(-)
 create mode 100644 core/krb5/krb5-1.9.1-2011-007.patch

(limited to 'core/krb5')

diff --git a/core/krb5/PKGBUILD b/core/krb5/PKGBUILD
index 065797f99..e93b19963 100644
--- a/core/krb5/PKGBUILD
+++ b/core/krb5/PKGBUILD
@@ -1,9 +1,9 @@
-# $Id: PKGBUILD 142223 2011-11-06 13:03:25Z stephane $
+# $Id: PKGBUILD 144896 2011-12-09 11:55:57Z stephane $
 # Maintainer: Stéphane Gaudreault <stephane@archlinux.org>
 
 pkgname=krb5
 pkgver=1.9.2
-pkgrel=1
+pkgrel=2
 pkgdesc="The Kerberos network authentication system"
 arch=('i686' 'x86_64')
 url="http://web.mit.edu/kerberos/"
@@ -18,12 +18,14 @@ source=(http://web.mit.edu/kerberos/dist/${pkgname}/1.9/${pkgname}-${pkgver}-sig
         krb5-kadmind
         krb5-kdc
         krb5-kpropd
-        krb5-1.9.1-config-script.patch)
+        krb5-1.9.1-config-script.patch
+        krb5-1.9.1-2011-007.patch)
 sha1sums=('aa06f778ee1f9791cd4c5cf4c9e9465769ffec92'
           '2aa229369079ed1bbb201a1ef72c47bf143f4dbe'
           '77d2312ecd8bf12a6e72cc8fd871a8ac93b23393'
           '7f402078fa65bb9ff1beb6cbbbb017450df78560'
-          '7342410760cf44bfa01bb99bb4c49e12496cb46f')
+          '7342410760cf44bfa01bb99bb4c49e12496cb46f'
+          'ec917dd1d1c96fa331f512331d5aa37c2e9b9df7')
 options=('!emptydirs')
 
 build() {
@@ -37,10 +39,15 @@ build() {
    #   by libkrb5, unless do_deps is set to 1, which indicates that the caller
    #   wants the whole list.
    #
-   #   Patch from upstream : 
+   #   Patch from upstream :
    #   http://anonsvn.mit.edu/viewvc/krb5/trunk/src/krb5-config.in?r1=23662&r2=25236
    patch -Np2 -i ${srcdir}/krb5-1.9.1-config-script.patch
 
+   # Apply upstream patch to fix a null pointer dereference when processing TGS requests
+   # CVE-2011-1530
+   # see http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-007.txt
+   patch -Np2 -i ${srcdir}/krb5-1.9.1-2011-007.patch
+
    # FS#25384
    sed -i "/KRB5ROOT=/s/\/local//" util/ac_check_krb5.m4
 
diff --git a/core/krb5/krb5-1.9.1-2011-007.patch b/core/krb5/krb5-1.9.1-2011-007.patch
new file mode 100644
index 000000000..336a4ad31
--- /dev/null
+++ b/core/krb5/krb5-1.9.1-2011-007.patch
@@ -0,0 +1,40 @@
+diff --git a/src/kdc/Makefile.in b/src/kdc/Makefile.in
+index f46cad3..102fbaa 100644
+--- a/src/kdc/Makefile.in
++++ b/src/kdc/Makefile.in
+@@ -67,6 +67,7 @@ check-unix:: rtest
+ 
+ check-pytests::
+ 	$(RUNPYTEST) $(srcdir)/t_workers.py $(PYTESTFLAGS)
++	$(RUNPYTEST) $(srcdir)/t_emptytgt.py $(PYTESTFLAGS)
+ 
+ install::
+ 	$(INSTALL_PROGRAM) krb5kdc ${DESTDIR}$(SERVER_BINDIR)/krb5kdc
+diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
+index c169c54..840a2ef 100644
+--- a/src/kdc/do_tgs_req.c
++++ b/src/kdc/do_tgs_req.c
+@@ -243,7 +243,8 @@ tgt_again:
+                     if (!tgs_1 || !data_eq(*server_1, *tgs_1)) {
+                         errcode = find_alternate_tgs(request, &server);
+                         firstpass = 0;
+-                        goto tgt_again;
++                        if (errcode == 0)
++                            goto tgt_again;
+                     }
+                 }
+                 status = "UNKNOWN_SERVER";
+diff --git a/src/kdc/t_emptytgt.py b/src/kdc/t_emptytgt.py
+new file mode 100644
+index 0000000..1760bcd
+--- /dev/null
++++ b/src/kdc/t_emptytgt.py
+@@ -0,0 +1,8 @@
++#!/usr/bin/python
++from k5test import *
++
++realm = K5Realm(start_kadmind=False, create_host=False)
++output = realm.run_as_client([kvno, 'krbtgt/'], expected_code=1)
++if 'not found in Kerberos database' not in output:
++    fail('TGT lookup for empty realm failed in unexpected way')
++success('Empty tgt lookup.')
-- 
cgit v1.2.3-54-g00ecf