Import of Heimdal Kerberos from KTH repository circa 2002/09/16.

35 files changed, 584 insertions, 503 deletions

diff --git a/crypto/heimdal/lib/krb5/Makefile.am b/crypto/heimdal/lib/krb5/Makefile.am
index e88a28e..ae75808 100644
--- a/crypto/heimdal/lib/krb5/Makefile.am
+++ b/crypto/heimdal/lib/krb5/Makefile.am
@@ -1,4 +1,4 @@
-# $Id: Makefile.am,v 1.145 2002/08/29 04:02:24 assar Exp $
+# $Id: Makefile.am,v 1.147 2002/09/03 14:45:13 joda Exp $
 
 include $(top_srcdir)/Makefile.am.common
 
@@ -13,7 +13,8 @@ TESTS =						\
 	string-to-key-test			\
 	derived-key-test			\
 	store-test				\
-	parse-name-test
+	parse-name-test				\
+	name-45-test
 
 check_PROGRAMS = $(TESTS)
 
@@ -133,10 +134,10 @@ libkrb5_la_LDFLAGS = -version-info 18:3:1
 
 $(libkrb5_la_OBJECTS): $(srcdir)/krb5-protos.h $(srcdir)/krb5-private.h
 
-$(srcdir)/krb5-protos.h: $(ERR_FILES)
+$(srcdir)/krb5-protos.h:
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -o krb5-protos.h $(libkrb5_la_SOURCES) || rm -f krb5-protos.h
 
-$(srcdir)/krb5-private.h: $(ERR_FILES)
+$(srcdir)/krb5-private.h:
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p krb5-private.h $(libkrb5_la_SOURCES) || rm -f krb5-private.h
 
 #libkrb5_la_LIBADD = ../com_err/error.lo ../com_err/com_err.lo
diff --git a/crypto/heimdal/lib/krb5/Makefile.in b/crypto/heimdal/lib/krb5/Makefile.in
index 7126546..80ce39f 100644
--- a/crypto/heimdal/lib/krb5/Makefile.in
+++ b/crypto/heimdal/lib/krb5/Makefile.in
@@ -14,7 +14,7 @@
 
 @SET_MAKE@
 
-# $Id: Makefile.am,v 1.145 2002/08/29 04:02:24 assar Exp $
+# $Id: Makefile.am,v 1.147 2002/09/03 14:45:13 joda Exp $
 
 # $Id: Makefile.am.common,v 1.5 2002/05/19 18:35:37 joda Exp $
 
@@ -211,7 +211,8 @@ TESTS = \
 	string-to-key-test			\
 	derived-key-test			\
 	store-test				\
-	parse-name-test
+	parse-name-test				\
+	name-45-test
 
 
 check_PROGRAMS = $(TESTS)
@@ -406,7 +407,7 @@ libkrb5_la_OBJECTS = $(am_libkrb5_la_OBJECTS)
 bin_PROGRAMS = verify_krb5_conf$(EXEEXT)
 check_PROGRAMS = n-fold-test$(EXEEXT) string-to-key-test$(EXEEXT) \
 	derived-key-test$(EXEEXT) store-test$(EXEEXT) \
-	parse-name-test$(EXEEXT)
+	parse-name-test$(EXEEXT) name-45-test$(EXEEXT)
 noinst_PROGRAMS = dump_config$(EXEEXT) test_get_addrs$(EXEEXT) \
 	krbhst-test$(EXEEXT)
 PROGRAMS = $(bin_PROGRAMS) $(noinst_PROGRAMS)
@@ -435,6 +436,12 @@ n_fold_test_LDADD = $(LDADD)
 n_fold_test_DEPENDENCIES = libkrb5.la \
 	$(top_builddir)/lib/asn1/libasn1.la
 n_fold_test_LDFLAGS =
+name_45_test_SOURCES = name-45-test.c
+name_45_test_OBJECTS = name-45-test.$(OBJEXT)
+name_45_test_LDADD = $(LDADD)
+name_45_test_DEPENDENCIES = libkrb5.la \
+	$(top_builddir)/lib/asn1/libasn1.la
+name_45_test_LDFLAGS =
 parse_name_test_SOURCES = parse-name-test.c
 parse_name_test_OBJECTS = parse-name-test.$(OBJEXT)
 parse_name_test_LDADD = $(LDADD)
@@ -481,13 +488,14 @@ LINK = $(LIBTOOL) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
 	$(AM_LDFLAGS) $(LDFLAGS) -o $@
 CFLAGS = @CFLAGS@
 DIST_SOURCES = $(libkrb5_la_SOURCES) derived-key-test.c dump_config.c \
-	krbhst-test.c n-fold-test.c parse-name-test.c store-test.c \
-	string-to-key-test.c test_get_addrs.c verify_krb5_conf.c
+	krbhst-test.c n-fold-test.c name-45-test.c parse-name-test.c \
+	store-test.c string-to-key-test.c test_get_addrs.c \
+	verify_krb5_conf.c
 MANS = $(man_MANS)
 HEADERS = $(include_HEADERS)
 
 DIST_COMMON = $(include_HEADERS) Makefile.am Makefile.in
-SOURCES = $(libkrb5_la_SOURCES) derived-key-test.c dump_config.c krbhst-test.c n-fold-test.c parse-name-test.c store-test.c string-to-key-test.c test_get_addrs.c verify_krb5_conf.c
+SOURCES = $(libkrb5_la_SOURCES) derived-key-test.c dump_config.c krbhst-test.c n-fold-test.c name-45-test.c parse-name-test.c store-test.c string-to-key-test.c test_get_addrs.c verify_krb5_conf.c
 
 all: all-am
 
@@ -583,6 +591,9 @@ krbhst-test$(EXEEXT): $(krbhst_test_OBJECTS) $(krbhst_test_DEPENDENCIES)
 n-fold-test$(EXEEXT): $(n_fold_test_OBJECTS) $(n_fold_test_DEPENDENCIES) 
 	@rm -f n-fold-test$(EXEEXT)
 	$(LINK) $(n_fold_test_LDFLAGS) $(n_fold_test_OBJECTS) $(n_fold_test_LDADD) $(LIBS)
+name-45-test$(EXEEXT): $(name_45_test_OBJECTS) $(name_45_test_DEPENDENCIES) 
+	@rm -f name-45-test$(EXEEXT)
+	$(LINK) $(name_45_test_LDFLAGS) $(name_45_test_OBJECTS) $(name_45_test_LDADD) $(LIBS)
 parse-name-test$(EXEEXT): $(parse_name_test_OBJECTS) $(parse_name_test_DEPENDENCIES) 
 	@rm -f parse-name-test$(EXEEXT)
 	$(LINK) $(parse_name_test_LDFLAGS) $(parse_name_test_OBJECTS) $(parse_name_test_LDADD) $(LIBS)
@@ -1121,10 +1132,10 @@ install-data-local: install-cat-mans
 
 $(libkrb5_la_OBJECTS): $(srcdir)/krb5-protos.h $(srcdir)/krb5-private.h
 
-$(srcdir)/krb5-protos.h: $(ERR_FILES)
+$(srcdir)/krb5-protos.h:
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -o krb5-protos.h $(libkrb5_la_SOURCES) || rm -f krb5-protos.h
 
-$(srcdir)/krb5-private.h: $(ERR_FILES)
+$(srcdir)/krb5-private.h:
 	cd $(srcdir) && perl ../../cf/make-proto.pl -q -P comment -p krb5-private.h $(libkrb5_la_SOURCES) || rm -f krb5-private.h
 
 $(libkrb5_la_OBJECTS): krb5_err.h heim_err.h k524_err.h
diff --git a/crypto/heimdal/lib/krb5/auth_context.c b/crypto/heimdal/lib/krb5/auth_context.c
index 3b42ce7..2e7a8f4 100644
--- a/crypto/heimdal/lib/krb5/auth_context.c
+++ b/crypto/heimdal/lib/krb5/auth_context.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: auth_context.c,v 1.58 2002/08/15 08:23:07 joda Exp $");
+RCSID("$Id: auth_context.c,v 1.59 2002/09/02 17:11:02 joda Exp $");
 
 krb5_error_code
 krb5_auth_con_init(krb5_context context,
@@ -292,6 +292,24 @@ krb5_auth_con_setlocalsubkey(krb5_context context,
 }
 
 krb5_error_code
+krb5_auth_con_generatelocalsubkey(krb5_context context,
+				  krb5_auth_context auth_context,
+				  krb5_keyblock *key)
+{
+    krb5_error_code ret;
+    krb5_keyblock *subkey;
+
+    ret = krb5_generate_subkey (context, key, &subkey);
+    if(ret)
+	return ret;
+    if(auth_context->local_subkey)
+	krb5_free_keyblock(context, auth_context->local_subkey);
+    auth_context->local_subkey = subkey;
+    return 0;
+}
+
+
+krb5_error_code
 krb5_auth_con_setremotesubkey(krb5_context context,
 			      krb5_auth_context auth_context,
 			      krb5_keyblock *keyblock)
diff --git a/crypto/heimdal/lib/krb5/build_ap_req.c b/crypto/heimdal/lib/krb5/build_ap_req.c
index e4f7d4e..cab5e6f 100644
--- a/crypto/heimdal/lib/krb5/build_ap_req.c
+++ b/crypto/heimdal/lib/krb5/build_ap_req.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: build_ap_req.c,v 1.17 2001/05/14 06:14:44 assar Exp $");
+RCSID("$Id: build_ap_req.c,v 1.18 2002/09/04 16:26:04 joda Exp $");
 
 krb5_error_code
 krb5_build_ap_req (krb5_context context,
@@ -66,15 +66,10 @@ krb5_build_ap_req (krb5_context context,
   ap.authenticator.kvno  = NULL;
   ap.authenticator.cipher = authenticator;
 
-  retdata->length = length_AP_REQ(&ap);
-  retdata->data   = malloc(retdata->length);
-  if(retdata->data == NULL) {
-      krb5_set_error_string(context, "malloc: out of memory");
-      ret = ENOMEM;
-  } else
-      encode_AP_REQ((unsigned char *)retdata->data + retdata->length - 1,
-		    retdata->length, &ap, &len);
+  ASN1_MALLOC_ENCODE(AP_REQ, retdata->data, retdata->length,
+		     &ap, &len, ret);
+
   free_AP_REQ(&ap);
-  
   return ret;
+
 }
diff --git a/crypto/heimdal/lib/krb5/build_auth.c b/crypto/heimdal/lib/krb5/build_auth.c
index b1650fd..9a2ca3e 100644
--- a/crypto/heimdal/lib/krb5/build_auth.c
+++ b/crypto/heimdal/lib/krb5/build_auth.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: build_auth.c,v 1.35 2001/05/14 06:14:44 assar Exp $");
+RCSID("$Id: build_auth.c,v 1.38 2002/09/04 16:26:04 joda Exp $");
 
 krb5_error_code
 krb5_build_authenticator (krb5_context context,
@@ -74,13 +74,6 @@ krb5_build_authenticator (krb5_context context,
   if(ret)
       goto fail;
 
-  if(auth->subkey == NULL) {
-      krb5_generate_subkey (context, &cred->session, &auth->subkey);
-      ret = krb5_auth_con_setlocalsubkey(context, auth_context, auth->subkey);
-      if(ret)
-	  goto fail;
-  }
-
   if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE) {
     krb5_generate_seq_number (context,
 			      &cred->session, 
@@ -99,36 +92,10 @@ krb5_build_authenticator (krb5_context context,
     auth_context->authenticator->cusec = auth->cusec;
   }
 
-  buf_size = 1024;
-  buf = malloc (buf_size);
-  if (buf == NULL) {
-      krb5_set_error_string(context, "malloc: out of memory");
-      ret = ENOMEM;
-      goto fail;
-  }
+  ASN1_MALLOC_ENCODE(Authenticator, buf, buf_size, auth, &len, ret);
 
-  do {
-      ret = krb5_encode_Authenticator (context,
-				       buf + buf_size - 1,
-				       buf_size,
-				       auth, &len);
-      if (ret) {
-	  if (ret == ASN1_OVERFLOW) {
-	      u_char *tmp;
-
-	      buf_size *= 2;
-	      tmp = realloc (buf, buf_size);
-	      if (tmp == NULL) {
-		  krb5_set_error_string(context, "malloc: out of memory");
-		  ret = ENOMEM;
-		  goto fail;
-	      }
-	      buf = tmp;
-	  } else {
-	      goto fail;
-	  }
-      }
-  } while(ret == ASN1_OVERFLOW);
+  if (ret)
+      goto fail;
 
   ret = krb5_crypto_init(context, &cred->session, enctype, &crypto);
   if (ret)
diff --git a/crypto/heimdal/lib/krb5/changepw.c b/crypto/heimdal/lib/krb5/changepw.c
index e930d87..f765a97 100644
--- a/crypto/heimdal/lib/krb5/changepw.c
+++ b/crypto/heimdal/lib/krb5/changepw.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: changepw.c,v 1.35 2002/06/06 13:33:13 joda Exp $");
+RCSID("$Id: changepw.c,v 1.37 2002/09/03 16:14:34 nectar Exp $");
 
 static krb5_error_code
 send_request (krb5_context context,
@@ -57,7 +57,7 @@ send_request (krb5_context context,
 
     ret = krb5_mk_req_extended (context,
 				auth_context,
-				AP_OPTS_MUTUAL_REQUIRED,
+				AP_OPTS_MUTUAL_REQUIRED | AP_OPTS_USE_SUBKEY,
 				NULL, /* in_data */
 				creds,
 				&ap_req_data);
@@ -144,7 +144,7 @@ process_reply (krb5_context context,
     u_char reply[BUFSIZ];
     size_t len;
     u_int16_t pkt_len, pkt_ver;
-    krb5_data ap_rep_data;
+    krb5_data ap_rep_data, priv_data;
     int save_errno;
 
     ret = recvfrom (sock, reply, sizeof(reply), 0, NULL, NULL);
@@ -173,10 +173,13 @@ process_reply (krb5_context context,
 
     ap_rep_data.data = reply + 6;
     ap_rep_data.length  = (reply[4] << 8) | (reply[5]);
+    priv_data.data   = (u_char*)ap_rep_data.data + ap_rep_data.length;
+    priv_data.length = len - ap_rep_data.length - 6;
+    if ((u_char *)priv_data.data + priv_data.length >= reply + len)
+	return KRB5_KPASSWD_MALFORMED;
   
     if (ap_rep_data.length) {
 	krb5_ap_rep_enc_part *ap_rep;
-	krb5_data priv_data;
 	u_char *p;
 
 	ret = krb5_rd_rep (context,
@@ -188,9 +191,6 @@ process_reply (krb5_context context,
 
 	krb5_free_ap_rep_enc_part (context, ap_rep);
 
-	priv_data.data   = (u_char*)ap_rep_data.data + ap_rep_data.length;
-	priv_data.length = len - ap_rep_data.length - 6;
-
 	ret = krb5_rd_priv (context,
 			    auth_context,
 			    &priv_data,
diff --git a/crypto/heimdal/lib/krb5/config_file.c b/crypto/heimdal/lib/krb5/config_file.c
index 77920a8..845b14c 100644
--- a/crypto/heimdal/lib/krb5/config_file.c
+++ b/crypto/heimdal/lib/krb5/config_file.c
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: config_file.c,v 1.45 2002/08/14 17:35:03 joda Exp $");
+RCSID("$Id: config_file.c,v 1.46 2002/09/10 19:04:55 joda Exp $");
 
 #ifndef HAVE_NETINFO
 
@@ -341,7 +341,7 @@ vget_next(krb5_context context,
 {
     const char *p = va_arg(args, const char *);
     while(b != NULL) {
-	if(strcmp(b->name, name) == NULL) {
+	if(strcmp(b->name, name) == 0) {
 	    if(b->type == type && p == NULL) {
 		*pointer = b;
 		return b->u.generic;
diff --git a/crypto/heimdal/lib/krb5/context.c b/crypto/heimdal/lib/krb5/context.c
index d21ea71..75fe347 100644
--- a/crypto/heimdal/lib/krb5/context.c
+++ b/crypto/heimdal/lib/krb5/context.c
@@ -34,7 +34,7 @@
 #include "krb5_locl.h"
 #include <com_err.h>
 
-RCSID("$Id: context.c,v 1.80 2002/08/28 15:27:24 joda Exp $");
+RCSID("$Id: context.c,v 1.81 2002/09/02 17:03:12 joda Exp $");
 
 #define INIT_FIELD(C, T, E, D, F)					\
     (C)->E = krb5_config_get_ ## T ## _default ((C), NULL, (D), 	\
@@ -173,14 +173,9 @@ init_context_from_config_file(krb5_context context)
     
     INIT_FIELD(context, bool, scan_interfaces, TRUE, "scan_interfaces");
     INIT_FIELD(context, int, fcache_vno, 0, "fcache_version");
-    INIT_FIELD(context, bool, srv_lookup, TRUE, "dns_lookup_kdc");
-    /* srv_lookup backwards compatibility. */
-    { 
-    const char **p;
-    p = krb5_config_get_strings(context, NULL, "libdefaults", "srv_lookup", NULL);
-    if (p != NULL)
-	INIT_FIELD(context, bool, srv_lookup, TRUE, "srv_lookup");
-    }
+    /* prefer dns_lookup_kdc over srv_lookup. */
+    INIT_FIELD(context, bool, srv_lookup, TRUE, "srv_lookup");
+    INIT_FIELD(context, bool, srv_lookup, context->srv_lookup, "dns_lookup_kdc");
     return 0;
 }
 
diff --git a/crypto/heimdal/lib/krb5/crypto.c b/crypto/heimdal/lib/krb5/crypto.c
index db9e810..65fa793 100644
--- a/crypto/heimdal/lib/krb5/crypto.c
+++ b/crypto/heimdal/lib/krb5/crypto.c
@@ -32,7 +32,7 @@
  */
 
 #include "krb5_locl.h"
-RCSID("$Id: crypto.c,v 1.64 2002/04/29 16:31:54 joda Exp $");
+RCSID("$Id: crypto.c,v 1.66 2002/09/03 19:58:15 joda Exp $");
 
 #undef CRYPTO_DEBUG
 #ifdef CRYPTO_DEBUG
@@ -1676,26 +1676,14 @@ DES3_CBC_encrypt(krb5_context context,
 		 size_t len, 
 		 krb5_boolean encrypt,
 		 int usage,
-		 void *ignore_ivec)
-{
-    des_cblock ivec;
-    des_key_schedule *s = key->schedule->data;
-    memset(&ivec, 0, sizeof(ivec));
-    des_ede3_cbc_encrypt(data, data, len, s[0], s[1], s[2], &ivec, encrypt);
-    return 0;
-}
-
-static krb5_error_code
-DES3_CBC_encrypt_ivec(krb5_context context,
-		      struct key_data *key, 
-		      void *data, 
-		      size_t len, 
-		      krb5_boolean encrypt,
-		      int usage,
-		      void *ivec)
+		 void *ivec)
 {
+    des_cblock local_ivec;
     des_key_schedule *s = key->schedule->data;
-
+    if(ivec == NULL) {
+	ivec = &local_ivec;
+	memset(local_ivec, 0, sizeof(local_ivec));
+    }
     des_ede3_cbc_encrypt(data, data, len, s[0], s[1], s[2], ivec, encrypt);
     return 0;
 }
@@ -2070,17 +2058,6 @@ static struct encryption_type enctype_des3_cbc_none = {
     F_PSEUDO,
     DES3_CBC_encrypt,
 };
-static struct encryption_type enctype_des3_cbc_none_ivec = {
-    ETYPE_DES3_CBC_NONE_IVEC,
-    "des3-cbc-none-ivec",
-    8,
-    0,
-    &keytype_des3_derived,
-    &checksum_none,
-    NULL,
-    F_PSEUDO,
-    DES3_CBC_encrypt_ivec,
-};
 
 static struct encryption_type *etypes[] = {
     &enctype_null,
@@ -2094,8 +2071,7 @@ static struct encryption_type *etypes[] = {
     &enctype_des_cbc_none,
     &enctype_des_cfb64_none,
     &enctype_des_pcbc_none,
-    &enctype_des3_cbc_none,
-    &enctype_des3_cbc_none_ivec
+    &enctype_des3_cbc_none
 };
 
 static unsigned num_etypes = sizeof(etypes) / sizeof(etypes[0]);
@@ -3057,6 +3033,15 @@ krb5_crypto_destroy(krb5_context context,
 }
 
 krb5_error_code
+krb5_crypto_getblocksize(krb5_context context,
+			 krb5_crypto crypto,
+			 size_t *blocksize)
+{
+    *blocksize = crypto->et->blocksize;
+    return 0;
+}
+
+krb5_error_code
 krb5_string_to_key_derived(krb5_context context,
 			   const void *str,
 			   size_t len,
diff --git a/crypto/heimdal/lib/krb5/get_cred.c b/crypto/heimdal/lib/krb5/get_cred.c
index 256234b..7aa61a3 100644
--- a/crypto/heimdal/lib/krb5/get_cred.c
+++ b/crypto/heimdal/lib/krb5/get_cred.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: get_cred.c,v 1.88 2002/03/10 23:11:29 assar Exp $");
+RCSID("$Id: get_cred.c,v 1.91 2002/09/04 21:12:46 joda Exp $");
 
 /*
  * Take the `body' and encode it into `padata' using the credentials
@@ -54,36 +54,14 @@ make_pa_tgs_req(krb5_context context,
     krb5_data in_data;
     krb5_error_code ret;
 
-    buf_size = 1024;
-    buf = malloc (buf_size);
-    if (buf == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	return ENOMEM;
-    }
-
-    do {
-	ret = encode_KDC_REQ_BODY(buf + buf_size - 1, buf_size,
-				  body, &len);
-	if (ret){
-	    if (ret == ASN1_OVERFLOW) {
-		u_char *tmp;
-
-		buf_size *= 2;
-		tmp = realloc (buf, buf_size);
-		if (tmp == NULL) {
-		    krb5_set_error_string(context, "malloc: out of memory");
-		    ret = ENOMEM;
-		    goto out;
-		}
-		buf = tmp;
-	    } else {
-		goto out;
-	    }
-	}
-    } while (ret == ASN1_OVERFLOW);
+    ASN1_MALLOC_ENCODE(KDC_REQ_BODY, buf, buf_size, body, &len, ret);
+    if (ret)
+	goto out;
+    if(buf_size != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
 
     in_data.length = len;
-    in_data.data   = buf + buf_size - len;
+    in_data.data   = buf;
     ret = krb5_mk_req_internal(context, &ac, 0, &in_data, creds,
 			       &padata->padata_value,
 			       KRB5_KU_TGS_REQ_AUTH_CKSUM,
@@ -113,18 +91,9 @@ set_auth_data (krb5_context context,
 	krb5_crypto crypto;
 	krb5_error_code ret;
 
-	len = length_AuthorizationData(authdata);
-	buf = malloc(len);
-	if (buf == NULL) {
-	    krb5_set_error_string(context, "malloc: out of memory");
-	    return ENOMEM;
-	}
-	ret = encode_AuthorizationData(buf + len - 1,
-				       len, authdata, &len);
-	if (ret) {
-	    free (buf);
+	ASN1_MALLOC_ENCODE(AuthorizationData, buf, len, authdata, &len, ret);
+	if (ret)
 	    return ret;
-	}
 
 	ALLOC(req_body->enc_authorization_data, 1);
 	if (req_body->enc_authorization_data == NULL) {
@@ -173,16 +142,19 @@ init_tgs_req (krb5_context context,
 	      TGS_REQ *t,
 	      krb5_key_usage usage)
 {
-    krb5_error_code ret;
+    krb5_error_code ret = 0;
 
     memset(t, 0, sizeof(*t));
     t->pvno = 5;
     t->msg_type = krb_tgs_req;
     if (in_creds->session.keytype) {
-	ret = krb5_keytype_to_enctypes_default (context,
-						in_creds->session.keytype,
-						&t->req_body.etype.len,
-						&t->req_body.etype.val);
+	ALLOC_SEQ(&t->req_body.etype, 1);
+	if(t->req_body.etype.val == NULL) {
+	    ret = ENOMEM;
+	    krb5_set_error_string(context, "malloc: out of memory");
+	    goto fail;
+	}
+	t->req_body.etype.val[0] = in_creds->session.keytype;
     } else {
 	ret = krb5_init_etype(context, 
 			      &t->req_body.etype.len, 
@@ -431,34 +403,11 @@ get_cred_kdc_usage(krb5_context context,
     if (ret)
 	goto out;
 
-    buf_size = 1024;
-    buf = malloc (buf_size);
-    if (buf == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	ret = ENOMEM;
+    ASN1_MALLOC_ENCODE(TGS_REQ, buf, buf_size, &req, &enc.length, ret);
+    if (ret) 
 	goto out;
-    }
-
-    do {
-	ret = encode_TGS_REQ  (buf + buf_size - 1, buf_size,
-			       &req, &enc.length);
-	if (ret) {
-	    if (ret == ASN1_OVERFLOW) {
-		u_char *tmp;
-
-		buf_size *= 2;
-		tmp = realloc (buf, buf_size);
-		if (tmp == NULL) {
-		    krb5_set_error_string(context, "malloc: out of memory");
-		    ret = ENOMEM;
-		    goto out;
-		}
-		buf = tmp;
-	    } else {
-		goto out;
-	    }
-	}
-    } while (ret == ASN1_OVERFLOW);
+    if(enc.length != buf_size)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
 
     /* don't free addresses */
     req.req_body.addresses = NULL;
diff --git a/crypto/heimdal/lib/krb5/get_for_creds.c b/crypto/heimdal/lib/krb5/get_for_creds.c
index 53a3f2b..2bec9f7 100644
--- a/crypto/heimdal/lib/krb5/get_for_creds.c
+++ b/crypto/heimdal/lib/krb5/get_for_creds.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: get_for_creds.c,v 1.32 2002/03/10 23:12:23 assar Exp $");
+RCSID("$Id: get_for_creds.c,v 1.34 2002/09/04 16:26:04 joda Exp $");
 
 static krb5_error_code
 add_addrs(krb5_context context,
@@ -162,12 +162,14 @@ krb5_get_forwarded_creds (krb5_context	    context,
     KrbCredInfo *krb_cred_info;
     EncKrbCredPart enc_krb_cred_part;
     size_t len;
-    u_char buf[1024];
+    unsigned char *buf;
+    size_t buf_size;
     int32_t sec, usec;
     krb5_kdc_flags kdc_flags;
     krb5_crypto crypto;
     struct addrinfo *ai;
     int save_errno;
+    krb5_keyblock *key;
 
     addrs.len = 0;
     addrs.val = NULL;
@@ -319,45 +321,51 @@ krb5_get_forwarded_creds (krb5_context	    context,
 
     /* encode EncKrbCredPart */
 
-    ret = krb5_encode_EncKrbCredPart (context,
-				      buf + sizeof(buf) - 1, sizeof(buf),
-				      &enc_krb_cred_part, &len);
+    ASN1_MALLOC_ENCODE(EncKrbCredPart, buf, buf_size, 
+		       &enc_krb_cred_part, &len, ret);
     free_EncKrbCredPart (&enc_krb_cred_part);
     if (ret) {
 	free_KRB_CRED(&cred);
 	return ret;
-    }    
+    }
+    if(buf_size != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
+
+    if (auth_context->local_subkey)
+	key = auth_context->local_subkey;
+    else if (auth_context->remote_subkey)
+	key = auth_context->remote_subkey;
+    else
+	key = auth_context->keyblock;
 
-    ret = krb5_crypto_init(context, auth_context->local_subkey, 0, &crypto);
+    ret = krb5_crypto_init(context, key, 0, &crypto);
     if (ret) {
+	free(buf);
 	free_KRB_CRED(&cred);
 	return ret;
     }
     ret = krb5_encrypt_EncryptedData (context,
 				      crypto,
 				      KRB5_KU_KRB_CRED,
-				      buf + sizeof(buf) - len,
+				      buf,
 				      len,
 				      0,
 				      &cred.enc_part);
+    free(buf);
     krb5_crypto_destroy(context, crypto);
     if (ret) {
 	free_KRB_CRED(&cred);
 	return ret;
     }
 
-    ret = encode_KRB_CRED (buf + sizeof(buf) - 1, sizeof(buf),
-			   &cred, &len);
+    ASN1_MALLOC_ENCODE(KRB_CRED, buf, buf_size, &cred, &len, ret);
     free_KRB_CRED (&cred);
     if (ret)
 	return ret;
+    if(buf_size != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
     out_data->length = len;
-    out_data->data   = malloc(len);
-    if (out_data->data == NULL) {
-	krb5_set_error_string(context, "malloc: out of memory");
-	return ENOMEM;
-    }
-    memcpy (out_data->data, buf + sizeof(buf) - len, len);
+    out_data->data   = buf;
     return 0;
 out4:
     free_EncKrbCredPart(&enc_krb_cred_part);
diff --git a/crypto/heimdal/lib/krb5/get_in_tkt.c b/crypto/heimdal/lib/krb5/get_in_tkt.c
index 04587ea..74a0204 100644
--- a/crypto/heimdal/lib/krb5/get_in_tkt.c
+++ b/crypto/heimdal/lib/krb5/get_in_tkt.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: get_in_tkt.c,v 1.104 2002/04/18 09:11:39 joda Exp $");
+RCSID("$Id: get_in_tkt.c,v 1.106 2002/09/04 16:26:04 joda Exp $");
 
 krb5_error_code
 krb5_init_etype (krb5_context context,
@@ -158,22 +158,12 @@ _krb5_extract_ticket(krb5_context context,
     creds->client = tmp_principal;
 
     /* extract ticket */
-    {
-	unsigned char *buf;
-	size_t len;
-	len = length_Ticket(&rep->kdc_rep.ticket);
-	buf = malloc(len);
-	if(buf == NULL) {
-	    krb5_set_error_string(context, "malloc: out of memory");
-	    ret = ENOMEM;
-	    goto out;
-	}
-	encode_Ticket(buf + len - 1, len, &rep->kdc_rep.ticket, &len);
-	creds->ticket.data = buf;
-	creds->ticket.length = len;
-	creds->second_ticket.length = 0;
-	creds->second_ticket.data   = NULL;
-    }
+    ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length, 
+		       &rep->kdc_rep.ticket, &creds->ticket.length, ret);
+    if(ret)
+	goto out;
+    creds->second_ticket.length = 0;
+    creds->second_ticket.data   = NULL;
 
     /* compare server */
 
@@ -223,7 +213,8 @@ _krb5_extract_ticket(krb5_context context,
     /* set kdc-offset */
 
     krb5_timeofday (context, &sec_now);
-    if (context->kdc_sec_offset == 0
+    if (rep->enc_part.flags.initial
+	&& context->kdc_sec_offset == 0
 	&& krb5_config_get_bool (context, NULL,
 				 "libdefaults",
 				 "kdc_timesync",
@@ -314,7 +305,8 @@ make_pa_enc_timestamp(krb5_context context, PA_DATA *pa,
 		      krb5_enctype etype, krb5_keyblock *key)
 {
     PA_ENC_TS_ENC p;
-    u_char buf[1024];
+    unsigned char *buf;
+    size_t buf_size;
     size_t len;
     EncryptedData encdata;
     krb5_error_code ret;
@@ -327,39 +319,37 @@ make_pa_enc_timestamp(krb5_context context, PA_DATA *pa,
     usec2         = usec;
     p.pausec      = &usec2;
 
-    ret = encode_PA_ENC_TS_ENC(buf + sizeof(buf) - 1,
-			       sizeof(buf),
-			       &p,
-			       &len);
+    ASN1_MALLOC_ENCODE(PA_ENC_TS_ENC, buf, buf_size, &p, &len, ret);
     if (ret)
 	return ret;
-
+    if(buf_size != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
     ret = krb5_crypto_init(context, key, 0, &crypto);
-    if (ret)
+    if (ret) {
+	free(buf);
 	return ret;
+    }
     ret = krb5_encrypt_EncryptedData(context, 
 				     crypto,
 				     KRB5_KU_PA_ENC_TIMESTAMP,
-				     buf + sizeof(buf) - len,
+				     buf,
 				     len,
 				     0,
 				     &encdata);
+    free(buf);
     krb5_crypto_destroy(context, crypto);
     if (ret)
 	return ret;
 		    
-    ret = encode_EncryptedData(buf + sizeof(buf) - 1,
-			       sizeof(buf),
-			       &encdata, 
-			       &len);
+    ASN1_MALLOC_ENCODE(EncryptedData, buf, buf_size, &encdata, &len, ret);
     free_EncryptedData(&encdata);
     if (ret)
 	return ret;
+    if(buf_size != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
     pa->padata_type = KRB5_PADATA_ENC_TIMESTAMP;
-    pa->padata_value.length = 0;
-    krb5_data_copy(&pa->padata_value,
-		   buf + sizeof(buf) - len,
-		   len);
+    pa->padata_value.length = len;
+    pa->padata_value.data = buf;
     return 0;
 }
 
@@ -656,7 +646,7 @@ krb5_get_in_cred(krb5_context context,
     AS_REQ a;
     krb5_kdc_rep rep;
     krb5_data req, resp;
-    char buf[BUFSIZ];
+    size_t len;
     krb5_salt salt;
     krb5_keyblock *key;
     size_t size;
@@ -692,17 +682,15 @@ krb5_get_in_cred(krb5_context context,
 	if (ret)
 	    return ret;
 
-	ret = encode_AS_REQ ((unsigned char*)buf + sizeof(buf) - 1,
-			     sizeof(buf),
-			     &a,
-			     &req.length);
+	ASN1_MALLOC_ENCODE(AS_REQ, req.data, req.length, &a, &len, ret);
 	free_AS_REQ(&a);
 	if (ret)
 	    return ret;
-
-	req.data = buf + sizeof(buf) - req.length;
+	if(len != req.length)
+	    krb5_abortx(context, "internal error in ASN.1 encoder");
 
 	ret = krb5_sendto_kdc (context, &req, &creds->client->realm, &resp);
+	krb5_data_free(&req);
 	if (ret)
 	    return ret;
 
diff --git a/crypto/heimdal/lib/krb5/keytab_keyfile.c b/crypto/heimdal/lib/krb5/keytab_keyfile.c
index 7dd0cd9..e4c4eb6 100644
--- a/crypto/heimdal/lib/krb5/keytab_keyfile.c
+++ b/crypto/heimdal/lib/krb5/keytab_keyfile.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: keytab_keyfile.c,v 1.13 2002/04/18 14:04:21 joda Exp $");
+RCSID("$Id: keytab_keyfile.c,v 1.14 2002/09/09 14:22:26 nectar Exp $");
 
 /* afs keyfile operations --------------------------------------- */
 
@@ -297,7 +297,7 @@ akf_add_entry(krb5_context context,
     fd = open (d->filename, O_RDWR | O_BINARY);
     if (fd < 0) {
 	fd = open (d->filename,
-		   O_RDWR | O_BINARY | O_CREAT, 0600);
+		   O_RDWR | O_BINARY | O_CREAT | O_EXCL, 0600);
 	if (fd < 0) {
 	    ret = errno;
 	    krb5_set_error_string(context, "open(%s): %s", d->filename,
diff --git a/crypto/heimdal/lib/krb5/krb5-protos.h b/crypto/heimdal/lib/krb5/krb5-protos.h
index 30ebf50..91a28f1 100644
--- a/crypto/heimdal/lib/krb5/krb5-protos.h
+++ b/crypto/heimdal/lib/krb5/krb5-protos.h
@@ -194,6 +194,12 @@ krb5_auth_con_genaddrs (
 	int /*flags*/);
 
 krb5_error_code
+krb5_auth_con_generatelocalsubkey (
+	krb5_context /*context*/,
+	krb5_auth_context /*auth_context*/,
+	krb5_keyblock */*key*/);
+
+krb5_error_code
 krb5_auth_con_getaddrs (
 	krb5_context /*context*/,
 	krb5_auth_context /*auth_context*/,
@@ -806,6 +812,12 @@ krb5_crypto_destroy (
 	krb5_crypto /*crypto*/);
 
 krb5_error_code
+krb5_crypto_getblocksize (
+	krb5_context /*context*/,
+	krb5_crypto /*crypto*/,
+	size_t */*blocksize*/);
+
+krb5_error_code
 krb5_crypto_init (
 	krb5_context /*context*/,
 	const krb5_keyblock */*key*/,
diff --git a/crypto/heimdal/lib/krb5/krb5.h b/crypto/heimdal/lib/krb5/krb5.h
index c50833e..cb035bc 100644
--- a/crypto/heimdal/lib/krb5/krb5.h
+++ b/crypto/heimdal/lib/krb5/krb5.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: krb5.h,v 1.203 2002/08/22 10:06:20 joda Exp $ */
+/* $Id: krb5.h,v 1.205 2002/09/03 17:31:47 joda Exp $ */
 
 #ifndef __KRB5_H__
 #define __KRB5_H__
@@ -99,7 +99,6 @@ enum {
     ENCTYPE_DES3_CBC_NONE	= ETYPE_DES3_CBC_NONE,
     ENCTYPE_DES_CFB64_NONE	= ETYPE_DES_CFB64_NONE,
     ENCTYPE_DES_PCBC_NONE	= ETYPE_DES_PCBC_NONE,
-    ENCTYPE_DES3_CBC_NONE_IVEC	= ETYPE_DES3_CBC_NONE_IVEC
 };
 
 typedef PADATA_TYPE krb5_preauthtype;
@@ -208,7 +207,8 @@ typedef enum krb5_address_type {
 
 enum {
   AP_OPTS_USE_SESSION_KEY = 1,
-  AP_OPTS_MUTUAL_REQUIRED = 2
+  AP_OPTS_MUTUAL_REQUIRED = 2,
+  AP_OPTS_USE_SUBKEY = 4		/* library internal */
 };
 
 typedef HostAddress krb5_address;
diff --git a/crypto/heimdal/lib/krb5/krb5_appdefault.3 b/crypto/heimdal/lib/krb5/krb5_appdefault.3
index 750bb75..f82ec7a 100644
--- a/crypto/heimdal/lib/krb5/krb5_appdefault.3
+++ b/crypto/heimdal/lib/krb5/krb5_appdefault.3
@@ -1,5 +1,5 @@
 .\" Copyright (c) 2000 Kungliga Tekniska Högskolan
-.\" $Id: krb5_appdefault.3,v 1.7 2002/08/28 15:30:46 joda Exp $
+.\" $Id: krb5_appdefault.3,v 1.8 2002/09/13 14:49:31 joda Exp $
 .Dd July 25, 2000
 .Dt KRB5_APPDEFAULT 3
 .Os HEIMDAL
@@ -19,7 +19,7 @@ Kerberos 5 Library (libkrb5, -lkrb5)
 .Ft void
 .Fn krb5_appdefault_time "krb5_context context" "const char *appname" "krb5_realm realm" "const char *option" "time_t def_val" "time_t *ret_val"
 .Sh DESCRIPTION
-These functions get application application defaults from the
+These functions get application defaults from the
 .Dv appdefaults
 section of the
 .Xr krb5.conf 5
diff --git a/crypto/heimdal/lib/krb5/krb5_auth_context.3 b/crypto/heimdal/lib/krb5/krb5_auth_context.3
index afc81e8..2afaec5 100644
--- a/crypto/heimdal/lib/krb5/krb5_auth_context.3
+++ b/crypto/heimdal/lib/krb5/krb5_auth_context.3
@@ -1,5 +1,5 @@
 .\" Copyright (c) 2001 Kungliga Tekniska Högskolan
-.\" $Id: krb5_auth_context.3,v 1.4 2002/08/28 14:46:20 joda Exp $
+.\" $Id: krb5_auth_context.3,v 1.5 2002/09/02 12:42:00 joda Exp $
 .Dd January 21, 2001
 .Dt KRB5_AUTH_CONTEXT 3
 .Os HEIMDAL
@@ -34,7 +34,7 @@
 .Nm krb5_auth_con_setrcache ,
 .Nm krb5_auth_con_initivector ,
 .Nm krb5_auth_con_setivector
-.Nd manage authetication on connection level
+.Nd manage authentication on connection level
 .Sh LIBRARY
 Kerberos 5 Library (libkrb5, -lkrb5)
 .Sh SYNOPSIS
diff --git a/crypto/heimdal/lib/krb5/krb5_context.3 b/crypto/heimdal/lib/krb5/krb5_context.3
index 6794f5a..a90ab72 100644
--- a/crypto/heimdal/lib/krb5/krb5_context.3
+++ b/crypto/heimdal/lib/krb5/krb5_context.3
@@ -1,5 +1,5 @@
 .\" Copyright (c) 2001 Kungliga Tekniska Högskolan
-.\" $Id: krb5_context.3,v 1.3 2002/08/28 15:30:48 joda Exp $
+.\" $Id: krb5_context.3,v 1.4 2002/09/02 12:42:00 joda Exp $
 .Dd January 21, 2001
 .Dt KRB5_CONTEXT 3
 .Os HEIMDAL
@@ -10,8 +10,8 @@
 The
 .Nm
 structure is designed to hold all per thread state. All global
-variables that are context specific are stored in this struture,
-including default encryption types, credential-cache (ticket file), and
+variables that are context specific are stored in this structure,
+including default encryption types, credentials-cache (ticket file), and
 default realms.
 .Pp
 The internals of the structure should never be accessed directly,
diff --git a/crypto/heimdal/lib/krb5/krb5_init_context.3 b/crypto/heimdal/lib/krb5/krb5_init_context.3
index e59b0d0..8a1141a 100644
--- a/crypto/heimdal/lib/krb5/krb5_init_context.3
+++ b/crypto/heimdal/lib/krb5/krb5_init_context.3
@@ -1,5 +1,5 @@
 .\" Copyright (c) 2001 Kungliga Tekniska Högskolan
-.\" $Id: krb5_init_context.3,v 1.5 2002/08/28 15:30:53 joda Exp $
+.\" $Id: krb5_init_context.3,v 1.6 2002/09/02 12:42:00 joda Exp $
 .Dd January 21, 2001
 .Dt KRB5_CONTEXT 3
 .Os HEIMDAL
@@ -20,7 +20,7 @@ The
 .Fn krb5_init_context
 function initializes the
 .Fa context
-structure and reads the configration file
+structure and reads the configuration file
 .Pa /etc/krb5.conf .
 .Pp
 The structure should be freed by calling
diff --git a/crypto/heimdal/lib/krb5/krb5_locl.h b/crypto/heimdal/lib/krb5/krb5_locl.h
index fceeaed..b3d6a92 100644
--- a/crypto/heimdal/lib/krb5/krb5_locl.h
+++ b/crypto/heimdal/lib/krb5/krb5_locl.h
@@ -31,7 +31,7 @@
  * SUCH DAMAGE. 
  */
 
-/* $Id: krb5_locl.h,v 1.69 2002/08/12 15:09:19 joda Exp $ */
+/* $Id: krb5_locl.h,v 1.71 2002/09/10 20:10:45 joda Exp $ */
 
 #ifndef __KRB5_LOCL_H__
 #define __KRB5_LOCL_H__
@@ -45,6 +45,7 @@
 #include <string.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <limits.h>
 
 #ifdef HAVE_SYS_TYPES_H
 #include <sys/types.h>
@@ -112,19 +113,7 @@ struct sockaddr_dl;
 #include <parse_time.h>
 #include <base64.h>
 
-#ifdef HAVE_OPENSSL
-#include <openssl/des.h>
-#include <openssl/md4.h>
-#include <openssl/md5.h>
-#include <openssl/sha.h>
-#include <openssl/rc4.h>
-#else
-#include <des.h>
-#include <md4.h>
-#include <md5.h>
-#include <sha.h>
-#include <rc4.h>
-#endif
+#include "crypto-headers.h"
 
 #include <krb5_asn1.h>
 #include <der.h>
diff --git a/crypto/heimdal/lib/krb5/krb5_parse_name.3 b/crypto/heimdal/lib/krb5/krb5_parse_name.3
index 1491117..285c4e2 100644
--- a/crypto/heimdal/lib/krb5/krb5_parse_name.3
+++ b/crypto/heimdal/lib/krb5/krb5_parse_name.3
@@ -1,5 +1,5 @@
 .\" Copyright (c) 1997 Kungliga Tekniska Högskolan
-.\" $Id: krb5_parse_name.3,v 1.5 2002/08/28 15:30:55 joda Exp $
+.\" $Id: krb5_parse_name.3,v 1.6 2002/09/02 12:42:00 joda Exp $
 .Dd August 8, 1997
 .Dt KRB5_PARSE_NAME 3
 .Os HEIMDAL
@@ -14,7 +14,7 @@ Kerberos 5 Library (libkrb5, -lkrb5)
 .Fn krb5_parse_name "krb5_context context" "const char *name" "krb5_principal *principal"
 .Sh DESCRIPTION
 .Fn krb5_parse_name
-converts a string representation of a princpal name to
+converts a string representation of a principal name to
 .Nm krb5_principal .
 The
 .Fa principal
diff --git a/crypto/heimdal/lib/krb5/krb5_unparse_name.3 b/crypto/heimdal/lib/krb5/krb5_unparse_name.3
index 0eee63b..e58b911 100644
--- a/crypto/heimdal/lib/krb5/krb5_unparse_name.3
+++ b/crypto/heimdal/lib/krb5/krb5_unparse_name.3
@@ -1,5 +1,5 @@
 .\" Copyright (c) 1997 Kungliga Tekniska Högskolan
-.\" $Id: krb5_unparse_name.3,v 1.5 2002/08/28 15:30:57 joda Exp $
+.\" $Id: krb5_unparse_name.3,v 1.6 2002/09/02 12:42:00 joda Exp $
 .Dd August 8, 1997
 .Dt KRB5_UNPARSE_NAME 3
 .Os HEIMDAL
@@ -18,7 +18,8 @@ Kerberos 5 Library (libkrb5, -lkrb5)
 .Sh DESCRIPTION
 This function takes a
 .Fa principal ,
-and will convert in to a printable representation with the same syntax as decribed in
+and will convert in to a printable representation with the same syntax
+as described in
 .Xr krb5_parse_name 3 .
 .Fa *name
 will point to allocated data and should be freed by the caller.
diff --git a/crypto/heimdal/lib/krb5/kuserok.c b/crypto/heimdal/lib/krb5/kuserok.c
index ae8ddec..17770c1 100644
--- a/crypto/heimdal/lib/krb5/kuserok.c
+++ b/crypto/heimdal/lib/krb5/kuserok.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: kuserok.c,v 1.5 1999/12/02 17:05:11 joda Exp $");
+RCSID("$Id: kuserok.c,v 1.6 2002/09/16 17:32:11 nectar Exp $");
 
 /*
  * Return TRUE iff `principal' is allowed to login as `luser'.
@@ -88,9 +88,7 @@ krb5_kuserok (krb5_context context,
     while (fgets (buf, sizeof(buf), f) != NULL) {
 	krb5_principal tmp;
 
-	if(buf[strlen(buf) - 1] == '\n')
-	    buf[strlen(buf) - 1] = '\0';
-
+	buf[strcspn(buf, "\n")] = '\0';
 	ret = krb5_parse_name (context, buf, &tmp);
 	if (ret) {
 	    fclose (f);
diff --git a/crypto/heimdal/lib/krb5/log.c b/crypto/heimdal/lib/krb5/log.c
index ecdb753..bd7451b 100644
--- a/crypto/heimdal/lib/krb5/log.c
+++ b/crypto/heimdal/lib/krb5/log.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: log.c,v 1.30 2002/08/20 09:49:09 joda Exp $");
+RCSID("$Id: log.c,v 1.31 2002/09/05 14:59:14 joda Exp $");
 
 struct facility {
     int min;
@@ -382,24 +382,33 @@ krb5_vlog_msg(krb5_context context,
 	      va_list ap)
      __attribute__((format (printf, 5, 0)))
 {
-    char *msg;
-    const char *actual;
+    
+    char *msg = NULL;
+    const char *actual = NULL;
     char buf[64];
-    time_t t;
+    time_t t = 0;
     int i;
 
-    vasprintf(&msg, fmt, ap);
-    if (msg != NULL)
-	actual = msg;
-    else
-	actual = fmt;
-    t = time(NULL);
-    krb5_format_time(context, t, buf, sizeof(buf), TRUE);
-    for(i = 0; i < fac->len; i++)
+    for(i = 0; fac && i < fac->len; i++)
 	if(fac->val[i].min <= level && 
-	   (fac->val[i].max < 0 || fac->val[i].max >= level))
+	   (fac->val[i].max < 0 || fac->val[i].max >= level)) {
+	    if(t == 0) {
+		t = time(NULL);
+		krb5_format_time(context, t, buf, sizeof(buf), TRUE);
+	    }
+	    if(actual == NULL) {
+		vasprintf(&msg, fmt, ap);
+		if(msg == NULL)
+		    actual = fmt;
+		else
+		    actual = msg;
+	    }
 	    (*fac->val[i].log)(buf, actual, fac->val[i].data);
-    *reply = msg;
+	}
+    if(reply == NULL)
+	free(msg);
+    else
+	*reply = msg;
     return 0;
 }
 
@@ -411,12 +420,7 @@ krb5_vlog(krb5_context context,
 	  va_list ap)
      __attribute__((format (printf, 4, 0)))
 {
-    char *msg;
-    krb5_error_code ret;
-
-    ret = krb5_vlog_msg(context, fac, &msg, level, fmt, ap);
-    free(msg);
-    return ret;
+    return krb5_vlog_msg(context, fac, NULL, level, fmt, ap);
 }
 
 krb5_error_code
diff --git a/crypto/heimdal/lib/krb5/mk_error.c b/crypto/heimdal/lib/krb5/mk_error.c
index 249f478..ae9e10a 100644
--- a/crypto/heimdal/lib/krb5/mk_error.c
+++ b/crypto/heimdal/lib/krb5/mk_error.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: mk_error.c,v 1.17 2002/03/27 09:29:43 joda Exp $");
+RCSID("$Id: mk_error.c,v 1.18 2002/09/04 16:26:04 joda Exp $");
 
 krb5_error_code
 krb5_mk_error(krb5_context context,
@@ -47,8 +47,6 @@ krb5_mk_error(krb5_context context,
 	      krb5_data *reply)
 {
     KRB_ERROR msg;
-    u_char *buf;
-    size_t buf_size;
     int32_t sec, usec;
     size_t len;
     krb5_error_code ret = 0;
@@ -84,45 +82,10 @@ krb5_mk_error(krb5_context context,
 	msg.cname = &client->name;
     }
 
-    buf_size = 1024;
-    buf = malloc (buf_size);
-    if (buf == NULL) {
-	krb5_set_error_string (context, "malloc: out of memory");
-	return ENOMEM;
-    }
-
-    do {
-	ret = encode_KRB_ERROR(buf + buf_size - 1,
-			       buf_size,
-			       &msg,
-			       &len);
-	if (ret) {
-	    if (ret == ASN1_OVERFLOW) {
-		u_char *tmp;
-
-		buf_size *= 2;
-		tmp = realloc (buf, buf_size);
-		if (tmp == NULL) {
-		    krb5_set_error_string (context, "malloc: out of memory");
-		    ret = ENOMEM;
-		    goto out;
-		}
-		buf = tmp;
-	    } else {
-		goto out;
-	    }
-	}
-    } while (ret == ASN1_OVERFLOW);
-
-    reply->length = len;
-    reply->data = malloc(len);
-    if (reply->data == NULL) {
-	krb5_set_error_string (context, "malloc: out of memory");
-	ret = ENOMEM;
-	goto out;
-    }
-    memcpy (reply->data, buf + buf_size - len, len);
-out:
-    free (buf);
-    return ret;
+    ASN1_MALLOC_ENCODE(KRB_ERROR, reply->data, reply->length, &msg, &len, ret);
+    if (ret)
+	return ret;
+    if(reply->length != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
+    return 0;
 }
diff --git a/crypto/heimdal/lib/krb5/mk_priv.c b/crypto/heimdal/lib/krb5/mk_priv.c
index 3f49a41..b89f7e9 100644
--- a/crypto/heimdal/lib/krb5/mk_priv.c
+++ b/crypto/heimdal/lib/krb5/mk_priv.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,12 +33,9 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: mk_priv.c,v 1.30 2001/06/18 02:44:54 assar Exp $");
-
-/*
- *
- */
+RCSID("$Id: mk_priv.c,v 1.31 2002/09/04 16:26:04 joda Exp $");
 
+      
 krb5_error_code
 krb5_mk_priv(krb5_context context,
 	     krb5_auth_context auth_context,
@@ -83,35 +80,11 @@ krb5_mk_priv(krb5_context context,
   part.s_address = auth_context->local_address;
   part.r_address = auth_context->remote_address;
 
-  buf_size = 1024;
-  buf = malloc (buf_size);
-  if (buf == NULL) {
-      krb5_set_error_string (context, "malloc: out of memory");
-      return ENOMEM;
-  }
-
   krb5_data_zero (&s.enc_part.cipher);
 
-  do {
-      ret = encode_EncKrbPrivPart (buf + buf_size - 1, buf_size,
-				   &part, &len);
-      if (ret) {
-	  if (ret == ASN1_OVERFLOW) {
-	      u_char *tmp;
-
-	      buf_size *= 2;
-	      tmp = realloc (buf, buf_size);
-	      if (tmp == NULL) {
-		  krb5_set_error_string (context, "malloc: out of memory");
-		  ret = ENOMEM;
-		  goto fail;
-	      }
-	      buf = tmp;
-	  } else {
-	      goto fail;
-	  }
-      }
-  } while(ret == ASN1_OVERFLOW);
+  ASN1_MALLOC_ENCODE(EncKrbPrivPart, buf, buf_size, &part, &len, ret);
+  if (ret)
+      goto fail;
 
   s.pvno = 5;
   s.msg_type = krb_priv;
@@ -134,37 +107,21 @@ krb5_mk_priv(krb5_context context,
       free(buf);
       return ret;
   }
+  free(buf);
+
 
-  do {
-      ret = encode_KRB_PRIV (buf + buf_size - 1, buf_size, &s, &len);
-
-      if (ret){
-	  if (ret == ASN1_OVERFLOW) {
-	      u_char *tmp;
-
-	      buf_size *= 2;
-	      tmp = realloc (buf, buf_size);
-	      if (tmp == NULL) {
-		  krb5_set_error_string (context, "malloc: out of memory");
-		  ret = ENOMEM;
-		  goto fail;
-	      }
-	      buf = tmp;
-	  } else {
-	      goto fail;
-	  }
-      }
-  } while(ret == ASN1_OVERFLOW);
+  ASN1_MALLOC_ENCODE(KRB_PRIV, buf, buf_size, &s, &len, ret);
+
+  if(ret)
+      goto fail;
   krb5_data_free (&s.enc_part.cipher);
 
-  outbuf->length = len;
-  outbuf->data   = malloc (len);
-  if (outbuf->data == NULL) {
+  ret = krb5_data_copy(outbuf, buf + buf_size - len, len);
+  if (ret) {
       krb5_set_error_string (context, "malloc: out of memory");
       free(buf);
       return ENOMEM;
   }
-  memcpy (outbuf->data, buf + buf_size - len, len);
   free (buf);
   if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE)
       auth_context->local_seqnumber =
diff --git a/crypto/heimdal/lib/krb5/mk_rep.c b/crypto/heimdal/lib/krb5/mk_rep.c
index fc6b4f2..b955555 100644
--- a/crypto/heimdal/lib/krb5/mk_rep.c
+++ b/crypto/heimdal/lib/krb5/mk_rep.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: mk_rep.c,v 1.19 2001/05/14 06:14:49 assar Exp $");
+RCSID("$Id: mk_rep.c,v 1.20 2002/09/04 16:26:05 joda Exp $");
 
 krb5_error_code
 krb5_mk_rep(krb5_context context,
@@ -72,21 +72,10 @@ krb5_mk_rep(krb5_context context,
   ap.enc_part.etype = auth_context->keyblock->keytype;
   ap.enc_part.kvno  = NULL;
 
-  buf_size = length_EncAPRepPart(&body);
-  buf = malloc (buf_size);
-  if (buf == NULL) {
-      free_EncAPRepPart (&body);
-      krb5_set_error_string (context, "malloc: out of memory");
-      return ENOMEM;
-  }
-
-  ret = krb5_encode_EncAPRepPart (context, 
-				  buf + buf_size - 1,
-				  buf_size,
-				  &body, 
-				  &len);
-
+  ASN1_MALLOC_ENCODE(EncAPRepPart, buf, buf_size, &body, &len, ret);
   free_EncAPRepPart (&body);
+  if(ret)
+      return ret;
   ret = krb5_crypto_init(context, auth_context->keyblock, 
 			 0 /* ap.enc_part.etype */, &crypto);
   if (ret) {
@@ -105,20 +94,7 @@ krb5_mk_rep(krb5_context context,
       return ret;
   }
 
-  buf_size = length_AP_REP(&ap);
-  buf = realloc(buf, buf_size);
-  if(buf == NULL) {
-      free_AP_REP (&ap);
-      krb5_set_error_string (context, "malloc: out of memory");
-      return ENOMEM;
-  }
-  ret = encode_AP_REP (buf + buf_size - 1, buf_size, &ap, &len);
-  
+  ASN1_MALLOC_ENCODE(AP_REP, outbuf->data, outbuf->length, &ap, &len, ret);
   free_AP_REP (&ap);
-
-  if(len != buf_size)
-      krb5_abortx(context, "krb5_mk_rep: encoded length != calculated length");
-  outbuf->data = buf;
-  outbuf->length = len;
-  return 0;
+  return ret;
 }
diff --git a/crypto/heimdal/lib/krb5/mk_req_ext.c b/crypto/heimdal/lib/krb5/mk_req_ext.c
index 5ab7a1c..aa5e3c4 100644
--- a/crypto/heimdal/lib/krb5/mk_req_ext.c
+++ b/crypto/heimdal/lib/krb5/mk_req_ext.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: mk_req_ext.c,v 1.25 2001/05/09 07:15:00 assar Exp $");
+RCSID("$Id: mk_req_ext.c,v 1.26 2002/09/02 17:13:52 joda Exp $");
 
 krb5_error_code
 krb5_mk_req_internal(krb5_context context,
@@ -62,6 +62,12 @@ krb5_mk_req_internal(krb5_context context,
   if(ret)
       return ret;
       
+  if(ac->local_subkey == NULL && (ap_req_options & AP_OPTS_USE_SUBKEY)) {
+      ret = krb5_auth_con_generatelocalsubkey(context, ac, &in_creds->session);
+      if(ret)
+	  return ret;
+  }
+
 #if 0
   {
       /* This is somewhat bogus since we're possibly overwriting a
diff --git a/crypto/heimdal/lib/krb5/mk_safe.c b/crypto/heimdal/lib/krb5/mk_safe.c
index 114aa8e..a839df4 100644
--- a/crypto/heimdal/lib/krb5/mk_safe.c
+++ b/crypto/heimdal/lib/krb5/mk_safe.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997 - 2001 Kungliga Tekniska Högskolan
+ * Copyright (c) 1997 - 2002 Kungliga Tekniska Högskolan
  * (Royal Institute of Technology, Stockholm, Sweden). 
  * All rights reserved. 
  *
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: mk_safe.c,v 1.27 2001/06/18 02:45:15 assar Exp $");
+RCSID("$Id: mk_safe.c,v 1.28 2002/09/04 16:26:05 joda Exp $");
 
 krb5_error_code
 krb5_mk_safe(krb5_context context,
@@ -48,7 +48,6 @@ krb5_mk_safe(krb5_context context,
   KerberosTime sec2;
   int usec2;
   u_char *buf = NULL;
-  void *tmp;
   size_t buf_size;
   size_t len;
   u_int32_t tmp_seq;
@@ -85,17 +84,11 @@ krb5_mk_safe(krb5_context context,
   s.cksum.checksum.data   = NULL;
   s.cksum.checksum.length = 0;
 
-  buf_size = length_KRB_SAFE(&s);
-  buf = malloc(buf_size + 128); /* add some for checksum */
-  if(buf == NULL) {
-      krb5_set_error_string (context, "malloc: out of memory");
-      return ENOMEM;
-  }
-  ret = encode_KRB_SAFE (buf + buf_size - 1, buf_size, &s, &len);
-  if (ret) {
-      free (buf);
+  ASN1_MALLOC_ENCODE(KRB_SAFE, buf, buf_size, &s, &len, ret);
+  if (ret)
       return ret;
-  }
+  if(buf_size != len)
+      krb5_abortx(context, "internal error in ASN.1 encoder");
   ret = krb5_crypto_init(context, key, 0, &crypto);
   if (ret) {
       free (buf);
@@ -105,7 +98,7 @@ krb5_mk_safe(krb5_context context,
 			     crypto,
 			     KRB5_KU_KRB_SAFE_CKSUM,
 			     0,
-			     buf + buf_size - len,
+			     buf,
 			     len,
 			     &s.cksum);
   krb5_crypto_destroy(context, crypto);
@@ -114,27 +107,16 @@ krb5_mk_safe(krb5_context context,
       return ret;
   }
 
-  buf_size = length_KRB_SAFE(&s);
-  tmp = realloc(buf, buf_size);
-  if(tmp == NULL) {
-      free(buf);
-      krb5_set_error_string (context, "malloc: out of memory");
-      return ENOMEM;
-  }
-  buf = tmp;
-  
-  ret = encode_KRB_SAFE (buf + buf_size - 1, buf_size, &s, &len);
+  free(buf);
+  ASN1_MALLOC_ENCODE(KRB_SAFE, buf, buf_size, &s, &len, ret);
   free_Checksum (&s.cksum);
+  if(ret)
+      return ret;
+  if(buf_size != len)
+      krb5_abortx(context, "internal error in ASN.1 encoder");
 
   outbuf->length = len;
-  outbuf->data   = malloc (len);
-  if (outbuf->data == NULL) {
-      free (buf);
-      krb5_set_error_string (context, "malloc: out of memory");
-      return ENOMEM;
-  }
-  memcpy (outbuf->data, buf + buf_size - len, len);
-  free (buf);
+  outbuf->data   = buf;
   if (auth_context->flags & KRB5_AUTH_CONTEXT_DO_SEQUENCE)
       auth_context->local_seqnumber =
 	  (auth_context->local_seqnumber + 1) & 0xFFFFFFFF;
diff --git a/crypto/heimdal/lib/krb5/name-45-test.c b/crypto/heimdal/lib/krb5/name-45-test.c
new file mode 100644
index 0000000..373586e
--- /dev/null
+++ b/crypto/heimdal/lib/krb5/name-45-test.c
@@ -0,0 +1,277 @@
+/*
+ * Copyright (c) 2002 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden). 
+ * All rights reserved. 
+ *
+ * Redistribution and use in source and binary forms, with or without 
+ * modification, are permitted provided that the following conditions 
+ * are met: 
+ *
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in the 
+ *    documentation and/or other materials provided with the distribution. 
+ *
+ * 3. Neither the name of KTH nor the names of its contributors may be
+ *    used to endorse or promote products derived from this software without
+ *    specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY KTH AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL KTH OR ITS CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
+ * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+ * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
+ * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */
+
+#include "krb5_locl.h"
+
+RCSID("$Id: name-45-test.c,v 1.2 2002/08/31 03:33:07 assar Exp $");
+
+enum { MAX_COMPONENTS = 3 };
+
+static struct testcase {
+    const char *v4_name;
+    const char *v4_inst;
+    const char *v4_realm;
+
+    krb5_realm v5_realm;
+    unsigned ncomponents;
+    char *comp_val[MAX_COMPONENTS];
+
+    const char *config_file;
+    krb5_error_code ret;	/* expected error code from 524 */
+
+    krb5_error_code ret2;	/* expected error code from 425 */
+} tests[] = {
+    {"", "", "", "", 1, {""}, NULL, 0, 0},
+    {"a", "", "", "", 1, {"a"}, NULL, 0, 0},
+    {"a", "b", "", "", 2, {"a", "b"}, NULL, 0, 0},
+    {"a", "b", "c", "c", 2, {"a", "b"}, NULL, 0, 0},
+
+    {"krbtgt", "FOO.SE", "FOO.SE", "FOO.SE", 2,
+     {"krbtgt", "FOO.SE"}, NULL, 0, 0},
+
+    {"foo", "bar", "BAZ", "BAZ", 2,
+     {"foo", "bar"}, NULL, 0, 0},
+    {"foo", "bar", "BAZ", "BAZ", 2,
+     {"foo", "bar"},
+     "[libdefaults]\n"
+     "	v4_name_convert = {\n"
+     "		host = {\n"
+     "			foo = foo5\n"
+     "		}\n"
+     "}\n",
+    HEIM_ERR_V4_PRINC_NO_CONV, 0},
+    {"foo", "bar", "BAZ", "BAZ", 2,
+     {"foo5", "bar.baz"},
+     "[realms]\n"
+     "  BAZ = {\n"
+     "		v4_name_convert = {\n"
+     "			host = {\n"
+     "				foo = foo5\n"
+     "			}\n"
+     "		}\n"
+     "		v4_instance_convert = {\n"
+     "			bar = bar.baz\n"
+     "		}\n"
+     "  }\n",
+     0, 0},
+
+    {"rcmd", "foo", "realm", "realm", 2, {"host", "foo"}, NULL,
+     HEIM_ERR_V4_PRINC_NO_CONV, 0},
+    {"rcmd", "foo", "realm", "realm", 2, {"host", "foo.realm"},
+     "[realms]\n"
+     "	realm = {\n"
+     "		v4_instance_convert = {\n"
+     "			foo = foo.realm\n"
+     "		}\n"
+     "	}\n",
+     0, 0},
+
+    {"pop", "mail0", "NADA.KTH.SE", "NADA.KTH.SE", 2,
+     {"pop", "mail0.nada.kth.se"}, NULL, HEIM_ERR_V4_PRINC_NO_CONV, 0},
+    {"pop", "mail0", "NADA.KTH.SE", "NADA.KTH.SE", 2,
+     {"pop", "mail0.nada.kth.se"},
+     "[realms]\n"
+     "	NADA.KTH.SE = {\n"
+     "		default_domain = nada.kth.se\n"
+     "	}\n",
+     0, 0},
+    {"pop", "mail0", "NADA.KTH.SE", "NADA.KTH.SE", 2,
+     {"pop", "mail0.nada.kth.se"},
+     "[libdefaults]\n"
+     "	v4_instance_resolve = true\n",
+     HEIM_ERR_V4_PRINC_NO_CONV, 0},
+
+    {"rcmd", "ratatosk", "NADA.KTH.SE", "NADA.KTH.SE", 2,
+     {"host", "ratatosk.pdc.kth.se"}, NULL, HEIM_ERR_V4_PRINC_NO_CONV, 0},
+    {"rcmd", "ratatosk", "NADA.KTH.SE", "NADA.KTH.SE", 2,
+     {"host", "ratatosk.pdc.kth.se"},
+     "[libdefaults]\n"
+     "	v4_instance_resolve = true\n"
+     "[realms]\n"
+     "	NADA.KTH.SE = {\n"
+     "		v4_name_convert = {\n"
+     "			host = {\n"
+     "				rcmd = host\n"
+     "			}\n"
+     "		}\n"
+     "		default_domain = pdc.kth.se\n"
+     "	}\n",
+     0, 0},
+
+    {"0123456789012345678901234567890123456789",
+     "0123456789012345678901234567890123456789",
+     "0123456789012345678901234567890123456789",
+     "0123456789012345678901234567890123456789",
+     2, {"0123456789012345678901234567890123456789",
+	 "0123456789012345678901234567890123456789"}, NULL,
+     0, KRB5_PARSE_MALFORMED},
+
+    {"012345678901234567890123456789012345678",
+     "012345678901234567890123456789012345678",
+     "012345678901234567890123456789012345678",
+     "012345678901234567890123456789012345678",
+     2, {"012345678901234567890123456789012345678",
+	 "012345678901234567890123456789012345678"}, NULL,
+     0, 0},
+
+    {NULL, NULL, NULL, NULL, 0, {}, NULL, 0}
+};
+
+int
+main(int argc, char **argv)
+{
+    struct testcase *t;
+    krb5_context context;
+    krb5_error_code ret;
+    int val = 0;
+
+    for (t = tests; t->v4_name; ++t) {
+	krb5_principal princ;
+	int i;
+	char name[40], inst[40], realm[40];
+	char printable_princ[256];
+
+	ret = krb5_init_context (&context);
+	if (ret)
+	    errx (1, "krb5_init_context failed: %d", ret);
+
+	if (t->config_file != NULL) {
+	    char template[] = "/tmp/krb5-conf-XXXXXX";
+	    int fd = mkstemp(template);
+	    char *files[2];
+
+	    if (fd < 0)
+		krb5_err (context, 1, errno, "mkstemp %s", template);
+
+	    if (write (fd, t->config_file, strlen(t->config_file))
+		!= strlen(t->config_file))
+		krb5_err (context, 1, errno, "write %s", template);
+	    close (fd);
+	    files[0] = template;
+	    files[1] = NULL;
+
+	    ret = krb5_set_config_files (context, files);
+	    unlink (template);
+	    if (ret)
+		krb5_err (context, 1, ret, "krb5_set_config_files");
+	}
+
+	ret = krb5_425_conv_principal (context,
+				       t->v4_name,
+				       t->v4_inst,
+				       t->v4_realm,
+				       &princ);
+	if (ret) {
+	    if (ret != t->ret) {
+		krb5_warn (context, ret,
+			   "krb5_425_conv_principal %s.%s@%s",
+			   t->v4_name, t->v4_inst, t->v4_realm);
+		val = 1;
+	    }
+	} else {
+	    if (t->ret) {
+		krb5_warnx (context,
+			    "krb5_425_conv_principal %s.%s@%s "
+			    "passed unexpected",
+			    t->v4_name, t->v4_inst, t->v4_realm);
+		val = 1;
+		continue;
+	    }
+	}
+
+	if (ret)
+	    continue;
+
+	if (strcmp (t->v5_realm, princ->realm) != 0) {
+	    printf ("wrong realm (\"%s\" should be \"%s\")"
+		    " for \"%s.%s@%s\"\n",
+		    princ->realm, t->v5_realm,
+		    t->v4_name,
+		    t->v4_inst,
+		    t->v4_realm);
+	    val = 1;
+	}
+
+	if (t->ncomponents != princ->name.name_string.len) {
+	    printf ("wrong number of components (%u should be %u)"
+		    " for \"%s.%s@%s\"\n",
+		    princ->name.name_string.len, t->ncomponents,
+		    t->v4_name,
+		    t->v4_inst,
+		    t->v4_realm);
+	    val = 1;
+	} else {
+	    for (i = 0; i < t->ncomponents; ++i) {
+		if (strcmp(t->comp_val[i],
+			   princ->name.name_string.val[i]) != 0) {
+		    printf ("bad component %d (\"%s\" should be \"%s\")"
+			    " for \"%s.%s@%s\"\n",
+			    i,
+			    princ->name.name_string.val[i],
+			    t->comp_val[i],
+			    t->v4_name,
+			    t->v4_inst,
+			    t->v4_realm);
+		    val = 1;
+		}
+	    }
+	}
+	ret = krb5_524_conv_principal (context, princ,
+				       name, inst, realm);
+	if (krb5_unparse_name_fixed(context, princ,
+				    printable_princ, sizeof(printable_princ)))
+	    strlcpy(printable_princ, "unknown principal",
+		    sizeof(printable_princ));
+	if (ret) {
+	    if (ret != t->ret2) {
+		krb5_warn (context, ret,
+			   "krb5_524_conv_principal %s", printable_princ);
+		val = 1;
+	    }
+	} else {
+	    if (t->ret2) {
+		krb5_warnx (context,
+			    "krb5_524_conv_principal %s "
+			    "passed unexpected", printable_princ);
+		val = 1;
+		continue;
+	    }
+	}
+	if (ret) {
+	    krb5_free_principal (context, princ);
+	    continue;
+	}
+
+	krb5_free_principal (context, princ);
+    }
+    return val;
+}
diff --git a/crypto/heimdal/lib/krb5/prompter_posix.c b/crypto/heimdal/lib/krb5/prompter_posix.c
index 4b9c573..4aea3a4 100644
--- a/crypto/heimdal/lib/krb5/prompter_posix.c
+++ b/crypto/heimdal/lib/krb5/prompter_posix.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: prompter_posix.c,v 1.6 2001/05/11 20:26:49 assar Exp $");
+RCSID("$Id: prompter_posix.c,v 1.7 2002/09/16 17:32:11 nectar Exp $");
 
 int
 krb5_prompter_posix (krb5_context context,
@@ -65,8 +65,7 @@ krb5_prompter_posix (krb5_context context,
 		     prompts[i].reply->length,
 		     stdin) == NULL)
 		return 1;
-	    if(s[strlen(s) - 1] == '\n')
-		s[strlen(s) - 1] = '\0';
+	    s[strcspn(s, "\n")] = '\0';
 	}
     }
     return 0;
diff --git a/crypto/heimdal/lib/krb5/rd_cred.c b/crypto/heimdal/lib/krb5/rd_cred.c
index 401770b..4a7d74c 100644
--- a/crypto/heimdal/lib/krb5/rd_cred.c
+++ b/crypto/heimdal/lib/krb5/rd_cred.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_cred.c,v 1.17 2002/08/09 17:07:12 joda Exp $");
+RCSID("$Id: rd_cred.c,v 1.18 2002/09/04 16:26:05 joda Exp $");
 
 krb5_error_code
 krb5_rd_cred(krb5_context context,
@@ -214,7 +214,6 @@ krb5_rd_cred(krb5_context context,
     for (i = 0; i < enc_krb_cred_part.ticket_info.len; ++i) {
 	KrbCredInfo *kci = &enc_krb_cred_part.ticket_info.val[i];
 	krb5_creds *creds;
-	u_char buf[1024];
 	size_t len;
 
 	creds = calloc(1, sizeof(*creds));
@@ -224,12 +223,12 @@ krb5_rd_cred(krb5_context context,
 	    goto out;
 	}
 
-	ret = encode_Ticket (buf + sizeof(buf) - 1, sizeof(buf),
-			     &cred.tickets.val[i],
-			     &len);
+	ASN1_MALLOC_ENCODE(Ticket, creds->ticket.data, creds->ticket.length, 
+			   &cred.tickets.val[i], &len, ret);
 	if (ret)
 	    goto out;
-	krb5_data_copy (&creds->ticket, buf + sizeof(buf) - len, len);
+	if(creds->ticket.length != len)
+	    krb5_abortx(context, "internal error in ASN.1 encoder");
 	copy_EncryptionKey (&kci->key, &creds->session);
 	if (kci->prealm && kci->pname)
 	    principalname2krb5_principal (&creds->client,
diff --git a/crypto/heimdal/lib/krb5/rd_safe.c b/crypto/heimdal/lib/krb5/rd_safe.c
index 71271c6..bbba237 100644
--- a/crypto/heimdal/lib/krb5/rd_safe.c
+++ b/crypto/heimdal/lib/krb5/rd_safe.c
@@ -33,7 +33,7 @@
 
 #include <krb5_locl.h>
 
-RCSID("$Id: rd_safe.c,v 1.26 2002/02/14 12:47:47 joda Exp $");
+RCSID("$Id: rd_safe.c,v 1.27 2002/09/04 16:26:05 joda Exp $");
 
 static krb5_error_code
 verify_checksum(krb5_context context,
@@ -53,19 +53,11 @@ verify_checksum(krb5_context context,
     safe->cksum.checksum.data   = NULL;
     safe->cksum.checksum.length = 0;
 
-    buf_size = length_KRB_SAFE(safe);
-    buf = malloc(buf_size);
-
-    if (buf == NULL) {
-	ret = ENOMEM;
-	krb5_set_error_string (context, "malloc: out of memory");
-	goto out;
-    }
-
-    ret = encode_KRB_SAFE (buf + buf_size - 1,
-			   buf_size,
-			   safe,
-			   &len);
+    ASN1_MALLOC_ENCODE(KRB_SAFE, buf, buf_size, safe, &len, ret);
+    if(ret)
+	return ret;
+    if(buf_size != len)
+	krb5_abortx(context, "internal error in ASN.1 encoder");
 
     if (auth_context->remote_subkey)
 	key = auth_context->remote_subkey;
diff --git a/crypto/heimdal/lib/krb5/sendauth.c b/crypto/heimdal/lib/krb5/sendauth.c
index 8f2c544..c2889ee 100644
--- a/crypto/heimdal/lib/krb5/sendauth.c
+++ b/crypto/heimdal/lib/krb5/sendauth.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: sendauth.c,v 1.18 2001/05/14 06:14:51 assar Exp $");
+RCSID("$Id: sendauth.c,v 1.19 2002/09/04 21:34:43 joda Exp $");
 
 /*
  * The format seems to be:
@@ -86,6 +86,7 @@ krb5_sendauth(krb5_context context,
     krb5_principal this_client = NULL;
     krb5_creds *creds;
     ssize_t sret;
+    krb5_boolean my_ccache = FALSE;
 
     len = strlen(version) + 1;
     net_len = htonl(len);
@@ -125,12 +126,16 @@ krb5_sendauth(krb5_context context,
 	    ret = krb5_cc_default (context, &ccache);
 	    if (ret)
 		return ret;
+	    my_ccache = TRUE;
 	}
 
 	if (client == NULL) {
 	    ret = krb5_cc_get_principal (context, ccache, &this_client);
-	    if (ret)
+	    if (ret) {
+		if(my_ccache)
+		    krb5_cc_close(context, ccache);
 		return ret;
+	    }
 	    client = this_client;
 	}
 	memset(&this_cred, 0, sizeof(this_cred));
@@ -142,11 +147,16 @@ krb5_sendauth(krb5_context context,
     }
     if (in_creds->ticket.length == 0) {
 	ret = krb5_get_credentials (context, 0, ccache, in_creds, &creds);
-	if (ret)
+	if (ret) {
+	    if(my_ccache)
+		krb5_cc_close(context, ccache);
 	    return ret;
+	}
     } else {
 	creds = in_creds;
     }
+    if(my_ccache)
+	krb5_cc_close(context, ccache);
     ret = krb5_mk_req_extended (context,
 				auth_context,
 				ap_req_options,
diff --git a/crypto/heimdal/lib/krb5/transited.c b/crypto/heimdal/lib/krb5/transited.c
index dbe6c80..b587c63 100644
--- a/crypto/heimdal/lib/krb5/transited.c
+++ b/crypto/heimdal/lib/krb5/transited.c
@@ -33,7 +33,7 @@
 
 #include "krb5_locl.h"
 
-RCSID("$Id: transited.c,v 1.8 2001/05/14 06:14:52 assar Exp $");
+RCSID("$Id: transited.c,v 1.9 2002/09/09 14:03:03 nectar Exp $");
 
 /* this is an attempt at one of the most horrible `compression'
    schemes that has ever been invented; it's so amazingly brain-dead
@@ -318,8 +318,9 @@ krb5_domain_x500_decode(krb5_context context,
     if(ret)
 	return ret;
     
-    /* remove empty components */
+    /* remove empty components and count realms */
     q = &r;
+    *num_realms = 0;
     for(p = r; p; ){
 	if(p->realm[0] == '\0'){
 	    free(p->realm);
@@ -329,22 +330,20 @@ krb5_domain_x500_decode(krb5_context context,
 	}else{
 	    q = &p->next;
 	    p = p->next;
+	    (*num_realms)++;
 	}
     }
+    if (*num_realms < 0 || *num_realms + 1 > UINT_MAX/sizeof(**realms))
+	return ERANGE;
+
     {
 	char **R;
-	*realms = NULL;
-	*num_realms = 0;
+	R = malloc((*num_realms + 1) * sizeof(*R));
+	if (R == NULL)
+	    return ENOMEM;
+	*realms = R;
 	while(r){
-	    R = realloc(*realms, (*num_realms + 1) * sizeof(**realms));
-	    if(R == NULL) {
-		free(*realms);
-		krb5_set_error_string (context, "malloc: out of memory");
-		return ENOMEM;
-	    }
-	    R[*num_realms] = r->realm;
-	    (*num_realms)++;
-	    *realms = R;
+	    *R++ = r->realm;
 	    p = r->next;
 	    free(r);
 	    r = p;