DEVEL15-rxkad-var-tkt-len-20060523

FIXES 31966

allocate memory for struct rxkad_cprivate based upon the actual
ticket size not the max ticket size


(cherry picked from commit 1344a69c57f6c2b8e0588e4b18b1178bc596f190)
This commit is contained in:
Hartmut Reuter 2006-06-01 16:38:59 +00:00 committed by Derrick Brashear
parent 5de6714250
commit f5d64d030b
3 changed files with 14 additions and 11 deletions

View File

@ -48,15 +48,17 @@ struct rxkad_cidgen {
afs_int32 ipAddr; /* or an approximation to it */
};
#define PDATA_SIZE(l) (sizeof(struct rxkad_cprivate) - MAXKTCTICKETLEN + (l))
/* private data in client-side security object */
struct rxkad_cprivate {
afs_int32 kvno; /* key version of ticket */
afs_int32 ticketLen; /* length of ticket */
afs_int16 ticketLen; /* length of ticket */
rxkad_type type; /* always client */
rxkad_level level; /* minimum security level of client */
fc_KeySchedule keysched; /* the session key */
fc_InitializationVector ivec; /* initialization vector for cbc */
char ticket[MAXKTCTICKETLEN]; /* the ticket for the server */
rxkad_type type; /* always client */
rxkad_level level; /* minimum security level of client */
};
/* Per connection client-side info */

View File

@ -181,7 +181,7 @@ rxkad_NewClientSecurityObject(rxkad_level level,
struct rx_securityClass *tsc;
struct rxkad_cprivate *tcp;
int code;
int size;
int size, psize;
size = sizeof(struct rx_securityClass);
tsc = (struct rx_securityClass *)rxi_Alloc(size);
@ -189,15 +189,15 @@ rxkad_NewClientSecurityObject(rxkad_level level,
tsc->refCount = 1; /* caller gets one for free */
tsc->ops = &rxkad_client_ops;
size = sizeof(struct rxkad_cprivate);
tcp = (struct rxkad_cprivate *)rxi_Alloc(size);
memset((void *)tcp, 0, size);
psize = PDATA_SIZE(ticketLen);
tcp = (struct rxkad_cprivate *)rxi_Alloc(psize);
memset((void *)tcp, 0, psize);
tsc->privateData = (char *)tcp;
tcp->type |= rxkad_client;
tcp->level = level;
code = fc_keysched(sessionkey, tcp->keysched);
if (code) {
rxi_Free(tcp, sizeof(struct rxkad_cprivate));
rxi_Free(tcp, psize);
rxi_Free(tsc, sizeof(struct rx_securityClass));
return 0; /* bad key */
}
@ -205,7 +205,7 @@ rxkad_NewClientSecurityObject(rxkad_level level,
tcp->kvno = kvno; /* key version number */
tcp->ticketLen = ticketLen; /* length of ticket */
if (tcp->ticketLen > MAXKTCTICKETLEN) {
rxi_Free(tcp, sizeof(struct rxkad_cprivate));
rxi_Free(tcp, psize);
rxi_Free(tsc, sizeof(struct rx_securityClass));
return 0; /* bad key */
}

View File

@ -68,7 +68,7 @@ RCSID
#include <strings.h>
#endif
#endif
#include <afs/afsutil.h>
#endif /* KERNEL */
#include <des/stats.h>
@ -311,7 +311,8 @@ FreeObject(struct rx_securityClass *aobj)
tcp = (struct rxkad_cprivate *)aobj->privateData;
rxi_Free(aobj, sizeof(struct rx_securityClass));
if (tcp->type & rxkad_client) {
rxi_Free(tcp, sizeof(struct rxkad_cprivate));
afs_int32 psize = PDATA_SIZE(tcp->ticketLen);
rxi_Free(tcp, psize);
} else if (tcp->type & rxkad_server) {
rxi_Free(tcp, sizeof(struct rxkad_sprivate));
} else {