Bad address during writev in weak_crypto mode

[Karsten Richter]

Ubuntu lucid (development branch) Release: 10.04
krb5-clients: 1:1.0~alpha1-1

krb5 1.8.1 breaks login to Solaris 10 SPARC (KRB5 1.6.2) using rlogin -x -l #PRINCIPALNAME# #HOSTNAME#
We use kerberized rlogin to solaris machines and after upgrading to lucid rcp works fine, rlogin doesn't ( new parameter allow_weak_crypto = true is set).

Server side log reports:
klogind[**PID***]: [ID ***ID*** auth.error] Error reading message

Traced the difference in the behaviour and found:
write(3, "#PRINCIPALNAME#\0", 9) = 9
write(3, "xterm/38400\0", 12) = 12
write(3, "#LOCALUSERNAME#\0", 9)
writev(3, [{"\0\0\0\0", 4}, {"", 0}], 2) = -1 EFAULT (Bad address)

Old behaviour (KRB5 version 1.7.1) was:
writev(4, [{"\0\0\0\0", 4}, {NULL, 0}], 2) = 4
read(4, "\0", 1) = 1

Analyzing the sourcecode I figured out that the behaviour of write_message() in kcmd.c causes the bad address.

adding "outbuf.data=NULL" in the non-forwarding case fixes the issue ( see attached patch):

    else { /* Dummy write to signal no forwarding */
        outbuf.length = 0;
+ outbuf.data=NULL;

[Shane Gary (shanegary)]

I think I have the same issue. However I am truing to login into a debian server from an ubuntu 10.04 client. I posted details in the forum

http://ubuntuforums.org/showthread.php?p=9803850#post9803850

[Dave Gilbert (ubuntu-treblig)]

Triaged: The reporter seems to have it down to a line of code.
Medium; I can see it might be seen as a High (high impact, small proportion of users?)

Karsten; have you found a work around for this in the last 2.5 years?
(Dave just randomly looking at old untriaged bugs).