[Bug 275915] kadmin(d): adding principal crashes in ARCFOUR_string_to_key

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=275915

            Bug ID: 275915
           Summary: kadmin(d): adding principal crashes in
                    ARCFOUR_string_to_key
           Product: Base System
           Version: 14.0-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: lexi.freebsd@le-fay.org

FreeBSD hemlock.eden.le-fay.org 14.0-RELEASE-p3 FreeBSD 14.0-RELEASE-p3 #5
releng/14.0-n265398-20fae1e16990: Fri Dec 15 22:12:51 GMT 2023    
root@hemlock.eden.le-fay.org:/data/src/obj/data/src/releng/14.0/amd64.amd64/sys/HEMLOCK
amd64

kadmin -l crashes in addprinc --random-key:

# gdb /usr/bin/kadmin
GNU gdb (GDB) 13.2 [GDB v13.2 for FreeBSD]
[...]
(gdb) run -l
Starting program: /usr/bin/kadmin -l
kadmin> add --random-key host/thyme.eden.le-fay.org
Max ticket life [1 day]:unlimited
Max renewable life [1 week]:unlimited
Principal expiration time [never]:
Password expiration time [never]:
Attributes []:

Program received signal SIGSEGV, Segmentation fault.
Address not mapped to object.
0x0000000000000000 in ?? ()
(gdb) where
#0  0x0000000000000000 in ?? ()
#1  0x0000000801126e68 in ARCFOUR_string_to_key (context=0x80201a000,
enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., opaque=...,
key=0x802134958)
    at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt-arcfour.c:84
#2  0x0000000801127f97 in krb5_string_to_key_data_salt_opaque
(enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, salt=..., opaque=...,
context=<optimized out>, password=...,
    key=<optimized out>) at
/data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:201
#3  krb5_string_to_key_data_salt (context=0x80201a000,
enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., key=0x802134958)
    at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:173
#4  0x000000080112817b in krb5_string_to_key_salt (context=0x80204be90,
context@entry=0x80201a000, enctype=-13001, password=0x0,
password@entry=0x7fffffffd1b0 "ys4tdErYgu",
    salt=..., key=0x4) at
/data/src/releng/14.0/crypto/heimdal/lib/krb5/salt.c:225
#5  0x00000008010a93a5 in hdb_generate_key_set_password (context=0x80201a000,
principal=<optimized out>, password=password@entry=0x7fffffffd1b0 "ys4tdErYgu",
    keys=keys@entry=0x7fffffffceb0, num_keys=num_keys@entry=0x7fffffffcea8) at
/data/src/releng/14.0/crypto/heimdal/lib/hdb/keys.c:381
#6  0x00000008010939fa in _kadm5_set_keys (context=context@entry=0x80201a140,
ent=ent@entry=0x7fffffffcef8, password=0x1 <error: Cannot access memory at
address 0x1>,
    password@entry=0x7fffffffd1b0 "ys4tdErYgu") at
/data/src/releng/14.0/crypto/heimdal/lib/kadm5/set_keys.c:51
#7  0x000000080108ea3c in kadm5_s_create_principal (server_handle=0x80201a140,
princ=<optimized out>, mask=<optimized out>, password=0x7fffffffd1b0
"ys4tdErYgu")
    at /data/src/releng/14.0/crypto/heimdal/lib/kadm5/create_s.c:172
#8  0x000000000102b64b in add_one_principal (name=<optimized out>, rand_key=1,
rand_password=0, use_defaults=0, password=0x7fffffffd1b0 "ys4tdErYgu",
key_data=0x0,
    max_ticket_life=<optimized out>, max_renewable_life=<optimized out>,
attributes=0x0, expiration=<optimized out>, pw_expiration=0x0)
    at /data/src/releng/14.0/crypto/heimdal/kadmin/ank.c:141
#9  add_new_key (opt=opt@entry=0x7fffffffd600, argc=argc@entry=1,
argv=0x802049290, argv@entry=0x802049280) at
/data/src/releng/14.0/crypto/heimdal/kadmin/ank.c:243
#10 0x000000000102f1ac in add_wrap (argc=<optimized out>, argv=0x802049280) at
kadmin-commands.c:210
#11 0x00000000010349be in sl_command (cmds=<optimized out>, argc=3,
argv=0x802049280) at /data/src/releng/14.0/crypto/heimdal/lib/sl/sl.c:209
#12 sl_command_loop (cmds=cmds@entry=0x10388b0 <commands>,
prompt=prompt@entry=0x1026cca "kadmin> ", data=<optimized out>)
    at /data/src/releng/14.0/crypto/heimdal/lib/sl/sl.c:328
#13 0x000000000102e896 in main (argc=<optimized out>, argv=<optimized out>) at
/data/src/releng/14.0/crypto/heimdal/kadmin/kadmin.c:275

(gdb) up
#1  0x0000000801126e68 in ARCFOUR_string_to_key (context=0x80201a000,
enctype=KRB5_ENCTYPE_ARCFOUR_HMAC_MD5, password=..., salt=..., opaque=...,
key=0x802134958)
    at /data/src/releng/14.0/crypto/heimdal/lib/krb5/salt-arcfour.c:84
84              EVP_DigestUpdate (m, &p, 1);

the same request in kadmin without -l causes kadmind to crash.

specifying a password instead of using --random-key also crashes.

-- 
You are receiving this mail because:
You are the assignee for the bug.