kauth: Fix overflow when writing ticket file

[openafs.git] / src / kauth / krb_tf.c

diff --git a/src/kauth/krb_tf.c b/src/kauth/krb_tf.c
index cbe296b..1ccb767 100644 (file)
--- a/src/kauth/krb_tf.c
+++ b/src/kauth/krb_tf.c
@@ -1,7 +1,7 @@
 /*
  * Copyright 2000, International Business Machines Corporation and others.
  * All Rights Reserved.
- * 
+ *
  * This software has been released under the terms of the IBM Public
  * License.  For details, see the LICENSE file in the top-level source
  * directory or online at http://www.openafs.org/dl/license10.html
@@ -44,52 +44,55 @@
 /* Inspite of what the above comment suggests the fields are not fixed length
    but null terminated as you might figure, except for the ticket which is
    preceded by a 4 byte length.  All fields in host order. 890306 */
-#include <afs/param.h>
 #include <afsconfig.h>
+#include <afs/param.h>
 
-RCSID("$Header$");
+#include <roken.h>
+#include <afs/opr.h>
 
-#ifdef AFS_NT40_ENV
-#include <fcntl.h>
-#include <io.h>
-#else
-#include <sys/file.h>
-#endif
-#include <sys/types.h>
 #include <rx/xdr.h>
-#include <errno.h>
 #include <afs/auth.h>
+
 #include "kauth.h"
 #include "kautils.h"
+#include "kauth_internal.h"
 
-afs_int32 krb_write_ticket_file (realm)
-  char *realm;
-{   char  ticket_file[AFSDIR_PATH_MAX];
-    int   fd;
-    int   count;
-    afs_int32  code;
-    int   lifetime, kvno;
+afs_int32
+krb_write_ticket_file(char *realm)
+{
+    int fd;
+    int count;
+    afs_int32 code;
+    int lifetime, kvno;
     char *tf_name;
     struct ktc_principal client, server;
     struct ktc_token token;
 
-    if ((strlen(realm) >= sizeof(client.cell))) return KABADNAME;
-    strcpy (server.name, KA_TGS_NAME);
-    strcpy (server.instance, realm);
-    lcstring (server.cell, realm, sizeof(server.cell));
+    if ((strlen(realm) >= sizeof(client.cell)))
+       return KABADNAME;
+    strcpy(server.name, KA_TGS_NAME);
+    strcpy(server.instance, realm);
+    lcstring(server.cell, realm, sizeof(server.cell));
 
-    code = ktc_GetToken (&server, &token, sizeof(struct ktc_token), &client);
-    if (code) return code;
+    code = ktc_GetToken(&server, &token, sizeof(struct ktc_token), &client);
+    if (code)
+       return code;
 
     /* Use the KRBTKFILE environment variable if it exists, otherwise fall
-     * back upon /tmp/tkt(uid}. 
+     * back upon /tmp/tkt(uid}.
      */
-    if (tf_name = (char *) getenv("KRBTKFILE"))
-       (void) sprintf(ticket_file, "%s", tf_name);
-    else
-       (void) sprintf(ticket_file, "%s/tkt%d", gettmpdir(), getuid());
-    fd = open (ticket_file, O_WRONLY+O_CREAT+O_TRUNC, 0700);
-    if (fd <= 0) return errno;
+    if ((tf_name = (char *)getenv("KRBTKFILE")))
+       fd = open(tf_name, O_WRONLY | O_CREAT | O_TRUNC, 0700);
+    else {
+       asprintf(&tf_name, "%s/tkt%d", gettmpdir(), getuid());
+       if (tf_name == NULL)
+           return ENOMEM;
+       fd = open(tf_name, O_WRONLY | O_CREAT | O_TRUNC, 0700);
+       free(tf_name);
+    }
+
+    if (fd <= 0)
+       return errno;
 
     /* write client name as file header */
 
@@ -111,37 +114,36 @@ afs_int32 krb_write_ticket_file (realm)
     if (write(fd, server.instance, count) != count)
        goto bad;
     /* Realm */
-    ucstring (server.cell, server.cell, sizeof(server.cell));
+    ucstring(server.cell, server.cell, sizeof(server.cell));
     count = strlen(server.cell) + 1;
     if (write(fd, server.cell, count) != count)
        goto bad;
     /* Session key */
-    if (write(fd, (char *) &token.sessionKey, 8) != 8)
+    if (write(fd, (char *)&token.sessionKey, 8) != 8)
        goto bad;
     /* Lifetime */
-    lifetime = time_to_life (token.startTime, token.endTime);
-    if (write(fd, (char *) &lifetime, sizeof(int)) != sizeof(int))
+    lifetime = time_to_life(token.startTime, token.endTime);
+    if (write(fd, (char *)&lifetime, sizeof(int)) != sizeof(int))
        goto bad;
     /* Key vno */
     kvno = token.kvno;
-    if (write(fd, (char *) &kvno, sizeof(int)) != sizeof(int))
+    if (write(fd, (char *)&kvno, sizeof(int)) != sizeof(int))
        goto bad;
     /* Tkt length */
-    if (write(fd, (char *) &(token.ticketLen), sizeof(int)) !=
-       sizeof(int))
+    if (write(fd, (char *)&(token.ticketLen), sizeof(int)) != sizeof(int))
        goto bad;
     /* Ticket */
     count = token.ticketLen;
-    if (write(fd, (char *) (token.ticket), count) != count)
+    if (write(fd, (char *)(token.ticket), count) != count)
        goto bad;
     /* Issue date */
-    if (write(fd, (char *) &token.startTime, sizeof(afs_int32))
+    if (write(fd, (char *)&(token.startTime), sizeof(afs_int32))
        != sizeof(afs_int32))
        goto bad;
-    close (fd);
+    close(fd);
     return 0;
 
   bad:
-    close (fd);
+    close(fd);
     return -1;
 }