[gentoo-commits] gentoo-x86 commit in app-crypt/mit-krb5/files: CVE-2014-4343.patch CVE-2014-4344.patch

[Eray Aslan (eras)]

eras        14/07/25 13:40:34

  Added:                CVE-2014-4343.patch CVE-2014-4344.patch
  Log:
  Security bump - bug #517936
  
  (Portage version: 2.2.10/cvs/Linux x86_64, signed Manifest commit with key 0x77F1F175586A3B1F)

Revision  Changes    Path
1.1                  app-crypt/mit-krb5/files/CVE-2014-4343.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-crypt/mit-krb5/files/CVE-2014-4343.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-crypt/mit-krb5/files/CVE-2014-4343.patch?rev=1.1&content-type=text/plain

Index: CVE-2014-4343.patch
===================================================================
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -818,7 +818,6 @@ init_ctx_reselect(OM_uint32 *minor_status, spnego_gss_ctx_id_t sc,
 	OM_uint32 tmpmin;
 	size_t i;
 
-	generic_gss_release_oid(&tmpmin, &sc->internal_mech);
 	gss_delete_sec_context(&tmpmin, &sc->ctx_handle,
 			       GSS_C_NO_BUFFER);
 




1.1                  app-crypt/mit-krb5/files/CVE-2014-4344.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-crypt/mit-krb5/files/CVE-2014-4344.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/app-crypt/mit-krb5/files/CVE-2014-4344.patch?rev=1.1&content-type=text/plain

Index: CVE-2014-4344.patch
===================================================================
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -1468,7 +1468,7 @@ acc_ctx_cont(OM_uint32 *minstat,
 
 	ptr = bufstart = buf->value;
 #define REMAIN (buf->length - (ptr - bufstart))
-	if (REMAIN > INT_MAX)
+	if (REMAIN == 0 || REMAIN > INT_MAX)
 		return GSS_S_DEFECTIVE_TOKEN;
 
 	/*