File krb5-1.6-MITKRB5-SA-2011-002.dif of Package krb5

Index: src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
===================================================================
--- src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	(revision 24590)
+++ src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c	(working copy)
@@ -81,10 +81,10 @@
     int *nentries;		/* how much room/how many found */
     krb5_boolean *more;		/* are there more? */
 {
-    char                        *user=NULL, *filter=NULL, **subtree=NULL;
+    char                        *user=NULL, *filter=NULL, *filtuser=NULL;
     unsigned int                tree=0, ntrees=1, princlen=0;
     krb5_error_code	        tempst=0, st=0;
-    char                        **values=NULL;
+    char                        **values=NULL, **subtree=NULL;
     LDAP	                *ld=NULL;
     LDAPMessage	                *result=NULL, *ent=NULL;
     krb5_ldap_context           *ldap_context=NULL;
@@ -119,12 +119,18 @@
     if ((st=krb5_ldap_unparse_principal_name(user)) != 0)
 	goto cleanup;
 
-    princlen = strlen(FILTER) + strlen(user) + 2 + 1;      /* 2 for closing brackets */
+    filtuser = ldap_filter_correct(user);
+    if (filtuser == NULL) {
+        st = ENOMEM;
+        goto cleanup;
+    }
+
+    princlen = strlen(FILTER) + strlen(filtuser) + 2 + 1;  /* 2 for closing brackets */
     if ((filter = malloc(princlen)) == NULL) {
 	st = ENOMEM;
 	goto cleanup;
     }
-    snprintf(filter, princlen, FILTER"%s))", user);
+    snprintf(filter, princlen, FILTER"%s))", filtuser);
 
     if ((st = krb5_get_subtree_info(ldap_context, &subtree, &ntrees)) != 0)
 	goto cleanup;
@@ -189,6 +195,9 @@
     if (user)
 	free(user);
 
+    if (filtuser)
+	free(filtuser);
+
     return st;
 }
 
Index: src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h
===================================================================
--- src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h	(revision 24590)
+++ src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.h	(working copy)
@@ -102,14 +102,18 @@
 #define LDAP_SEARCH(base, scope, filter, attrs)   LDAP_SEARCH_1(base, scope, filter, attrs, CHECK_STATUS)
 
 #define LDAP_SEARCH_1(base, scope, filter, attrs, status_check)        \
-      do { \
-	  st = ldap_search_ext_s(ld, base, scope, filter, attrs, 0, NULL, NULL, &timelimit, LDAP_NO_LIMIT, &result); \
-	  if (translate_ldap_error(st, OP_SEARCH) == KRB5_KDB_ACCESS_ERROR) { \
-              tempst = krb5_ldap_rebind(ldap_context, &ldap_server_handle); \
-	      if (ldap_server_handle) \
-		  ld = ldap_server_handle->ldap_handle; \
-	  } \
-      }while (translate_ldap_error(st, OP_SEARCH) == KRB5_KDB_ACCESS_ERROR && tempst == 0); \
+    tempst = 0;                                                         \
+    st = ldap_search_ext_s(ld, base, scope, filter, attrs, 0, NULL,     \
+                           NULL, &timelimit, LDAP_NO_LIMIT, &result);   \
+    if (translate_ldap_error(st, OP_SEARCH) == KRB5_KDB_ACCESS_ERROR) { \
+        tempst = krb5_ldap_rebind(ldap_context, &ldap_server_handle);   \
+        if (ldap_server_handle)                                         \
+            ld = ldap_server_handle->ldap_handle;                       \
+        if (tempst == 0)                                                \
+            st = ldap_search_ext_s(ld, base, scope, filter, attrs, 0,   \
+                                   NULL, NULL, &timelimit,              \
+                                   LDAP_NO_LIMIT, &result);             \
+    }                                                                   \
       \
       if (status_check != IGNORE_STATUS) { \
         if (tempst != 0) { \
Index: src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c
===================================================================
--- src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c	(revision 24590)
+++ src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap_conn.c	(working copy)
@@ -294,6 +294,7 @@
 {
     krb5_ldap_server_handle     *handle = *ldap_server_handle;
 
+    ldap_unbind_ext_s(handle->ldap_handle, NULL, NULL);
     if ((ldap_initialize(&handle->ldap_handle, handle->server_info->server_name) != LDAP_SUCCESS)
 	|| (krb5_ldap_bind(ldap_context, handle) != LDAP_SUCCESS))
 	return krb5_ldap_request_next_handle_from_pool(ldap_context, ldap_server_handle);
Index: src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
===================================================================
--- src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c	(revision 24590)
+++ src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c	(working copy)
@@ -439,10 +439,10 @@
      * "krbtgt".  All this check is done in the immediate block.
      */
     if (searchfor->length == 2)
-	if ((strncasecmp(searchfor->data[0].data, "krbtgt",
-			 FIND_MAX(searchfor->data[0].length, strlen("krbtgt"))) == 0) &&
-	    (strncasecmp(searchfor->data[1].data, defrealm,
-			 FIND_MAX(searchfor->data[1].length, defrealmlen)) == 0))
+	if ((searchfor->data[0].length == 6 &&
+	     strncmp(searchfor->data[0].data, "krbtgt", 6) == 0) &&
+	    (searchfor->data[1].length == defrealmlen &&
+	     strncmp(searchfor->data[1].data, defrealm, defrealmlen) == 0))
 	    return 0;
 
     /* first check the length, if they are not equal, then they are not same */