File krb5-1.6.3-post.dif of Package krb5

Overview Repositories Revisions Requests Users Attributes Meta

File krb5-1.6.3-post.dif of Package krb5 (Revision 382a3cfe383eff05d5b21b23fefb33d9)

Currently displaying revision 382a3cfe383eff05d5b21b23fefb33d9 , Show latest

Index: src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
===================================================================
--- src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c.orig
+++ src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.c
@@ -303,6 +303,11 @@ int main(argc, argv)
     krb5_boolean realm_name_required = TRUE;
     krb5_boolean print_help_message = FALSE;
 
+    /*
+     * Ensure that "progname" is set before calling com_err.
+     */
+    progname = (strrchr(argv[0], '/') ? strrchr(argv[0], '/')+1 : argv[0]);
+
     retval = krb5_init_context(&util_context);
     set_com_err_hook(extended_com_err_fn);
     if (retval) {
@@ -311,8 +316,6 @@ int main(argc, argv)
 	goto cleanup;
     }
 
-    progname = (strrchr(argv[0], '/') ? strrchr(argv[0], '/')+1 : argv[0]);
-
     cmd_argv = (char **) malloc(sizeof(char *)*argc);
     if (cmd_argv == NULL) {
 	com_err(progname, ENOMEM, "while creating sub-command arguments");
@@ -344,7 +347,7 @@ int main(argc, argv)
 	    }
 	} else if (strcmp(*argv, "-k") == 0 && ARG_VAL) {
 	    if (krb5_string_to_enctype(koptarg, &global_params.enctype))
-		com_err(argv[0], 0, "%s is an invalid enctype", koptarg);
+		com_err(progname, 0, "%s is an invalid enctype", koptarg);
 	    else
 		global_params.mask |= KADM5_CONFIG_ENCTYPE;
 	} else if (strcmp(*argv, "-M") == 0 && ARG_VAL) {
@@ -466,7 +469,7 @@ int main(argc, argv)
 	retval = kadm5_get_config_params(util_context, 1,
 					 &global_params, &global_params);
 	if (retval) {
-	    com_err(argv[0], retval, "while retreiving configuration parameters");
+	    com_err(progname, retval, "while retreiving configuration parameters");
 	    exit_status++;
 	    goto cleanup;
 	}
@@ -474,7 +477,7 @@ int main(argc, argv)
     }
 
     if ((retval = krb5_ldap_lib_init()) != 0) {
-	com_err(argv[0], retval, "while initializing error handling");
+	com_err(progname, retval, "while initializing error handling");
 	exit_status++;
 	goto cleanup;
     }
@@ -482,7 +485,7 @@ int main(argc, argv)
     /* Initialize the ldap context */
     ldap_context = calloc(sizeof(krb5_ldap_context), 1);
     if (ldap_context == NULL) {
-	com_err(argv[0], ENOMEM, "while initializing ldap handle");
+	com_err(progname, ENOMEM, "while initializing ldap handle");
 	exit_status++;
 	goto cleanup;
     }
@@ -495,7 +498,7 @@ int main(argc, argv)
 	if (passwd == NULL) {
 	    passwd = (char *)malloc(MAX_PASSWD_LEN);
 	    if (passwd == NULL) {
-		com_err(argv[0], ENOMEM, "while retrieving ldap configuration");
+		com_err(progname, ENOMEM, "while retrieving ldap configuration");
 		exit_status++;
 		goto cleanup;
 	    }
@@ -503,7 +506,7 @@ int main(argc, argv)
 	    if (prompt == NULL) {
 		free(passwd);
 		passwd = NULL;
-		com_err(argv[0], ENOMEM, "while retrieving ldap configuration");
+		com_err(progname, ENOMEM, "while retrieving ldap configuration");
 		exit_status++;
 		goto cleanup;
 	    }
@@ -514,7 +517,7 @@ int main(argc, argv)
 	    db_retval = krb5_read_password(util_context, prompt, NULL, passwd, &passwd_len);
 
 	    if ((db_retval) || (passwd_len == 0)) {
-		com_err(argv[0], ENOMEM, "while retrieving ldap configuration");
+		com_err(progname, ENOMEM, "while retrieving ldap configuration");
 		free(passwd);
 		passwd = NULL;
 		exit_status++;
@@ -530,14 +533,14 @@ int main(argc, argv)
 
 	ldap_context->server_info_list = (krb5_ldap_server_info **) calloc (2, sizeof (krb5_ldap_server_info *)) ;
 	if (ldap_context->server_info_list == NULL) {
-	    com_err(argv[0], ENOMEM, "while initializing server list");
+	    com_err(progname, ENOMEM, "while initializing server list");
 	    exit_status++;
 	    goto cleanup;
 	}
 
 	ldap_context->server_info_list[0] = (krb5_ldap_server_info *) calloc (1, sizeof (krb5_ldap_server_info));
 	if (ldap_context->server_info_list[0] == NULL) {
-	    com_err(argv[0], ENOMEM, "while initializing server list");
+	    com_err(progname, ENOMEM, "while initializing server list");
 	    exit_status++;
 	    goto cleanup;
 	}
@@ -546,7 +549,7 @@ int main(argc, argv)
 
 	ldap_context->server_info_list[0]->server_name = strdup(ldap_server);
 	if (ldap_context->server_info_list[0]->server_name == NULL) {
-	    com_err(argv[0], ENOMEM, "while initializing server list");
+	    com_err(progname, ENOMEM, "while initializing server list");
 	    exit_status++;
 	    goto cleanup;
 	}
@@ -554,7 +557,7 @@ int main(argc, argv)
     if (bind_dn) {
 	ldap_context->bind_dn = strdup(bind_dn);
 	if (ldap_context->bind_dn == NULL) {
-	    com_err(argv[0], ENOMEM, "while retrieving ldap configuration");
+	    com_err(progname, ENOMEM, "while retrieving ldap configuration");
 	    exit_status++;
 	    goto cleanup;
 	}
@@ -566,7 +569,7 @@ int main(argc, argv)
     if (realm_name_required) {
 	if ((global_params.enctype != ENCTYPE_UNKNOWN) &&
 	    (!krb5_c_valid_enctype(global_params.enctype))) {
-	    com_err(argv[0], KRB5_PROG_KEYTYPE_NOSUPP,
+	    com_err(progname, KRB5_PROG_KEYTYPE_NOSUPP,
 		    "while setting up enctype %d", global_params.enctype);
 	}
     }
@@ -583,7 +586,7 @@ int main(argc, argv)
 
     db_retval = krb5_ldap_read_server_params(util_context, conf_section, KRB5_KDB_SRV_TYPE_OTHER);
     if (db_retval) {
-	com_err(argv[0], db_retval, "while reading ldap configuration");
+	com_err(progname, db_retval, "while reading ldap configuration");
 	exit_status++;
 	goto cleanup;
     }
Index: src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
===================================================================
--- src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c.orig
+++ src/plugins/kdb/ldap/ldap_util/kdb5_ldap_policy.c
@@ -67,7 +67,7 @@ static krb5_error_code init_ldap_realm (
         retval = krb5_ldap_read_krbcontainer_params (util_context,
                 &(ldap_context->krbcontainer));
         if (retval != 0) {
-            com_err(argv[0], retval, "while reading kerberos container information");
+            com_err(progname, retval, "while reading kerberos container information");
             goto cleanup;
         }
     }
@@ -95,7 +95,7 @@ kdb5_ldap_create_policy(argc, argv)
     int argc;
     char *argv[];
 {
-    char *me = argv[0];
+    char *me = progname;
     krb5_error_code retval = 0;
     krb5_ldap_policy_params *policyparams = NULL;
     krb5_boolean print_usage = FALSE;
@@ -322,7 +322,7 @@ kdb5_ldap_destroy_policy(argc, argv)
     int argc;
     char *argv[];
 {
-    char *me = argv[0];
+    char *me = progname;
     krb5_error_code retval = 0;
     krb5_ldap_policy_params *policyparams = NULL;
     krb5_boolean print_usage = FALSE;
@@ -426,7 +426,7 @@ kdb5_ldap_modify_policy(argc, argv)
     int argc;
     char *argv[];
 {
-    char *me = argv[0];
+    char *me = progname;
     krb5_error_code retval = 0;
     krb5_ldap_policy_params *policyparams = NULL;
     krb5_boolean print_usage = FALSE;
@@ -683,7 +683,7 @@ kdb5_ldap_view_policy(argc, argv)
     int argc;
     char *argv[];
 {
-    char *me = argv[0];
+    char *me = progname;
     krb5_ldap_policy_params *policyparams = NULL;
     krb5_error_code retval = 0;
     krb5_boolean print_usage = FALSE;
@@ -804,7 +804,7 @@ void kdb5_ldap_list_policies(argc, argv)
     int argc;
     char *argv[];
 {
-    char *me = argv[0];
+    char *me = progname;
     krb5_error_code retval = 0;
     krb5_boolean print_usage = FALSE;
     char *basedn = NULL;
Index: src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
===================================================================
--- src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c.orig
+++ src/plugins/kdb/ldap/ldap_util/kdb5_ldap_realm.c
@@ -152,7 +152,7 @@ static int get_ticket_policy(rparams,i,a
     krb5_boolean no_msg = FALSE;
 
     krb5_boolean print_usage = FALSE;
-    char *me = argv[0];
+    char *me = progname;
 
     time(&now);
     if (!strcmp(argv[*i], "-maxtktlife")) {
@@ -364,7 +364,7 @@ void kdb5_ldap_create(argc, argv)
 		rparams->subtree = list;
 	    } else if(strncmp(argv[i], "", strlen(argv[i]))==0) {
 		 /* dont allow subtree value to be set at the root(NULL, "") of the tree */
-		 com_err(argv[0], EINVAL,
+		 com_err(progname, EINVAL,
 			  "for subtree while creating realm '%s'",
 			   global_params.realm);
 		 goto err_nomsg;
@@ -376,7 +376,7 @@ void kdb5_ldap_create(argc, argv)
 		goto err_usage;
 	    if(strncmp(argv[i], "", strlen(argv[i]))==0) {
 		 /* dont allow containerref value to be set at the root(NULL, "") of the tree */
-		 com_err(argv[0], EINVAL,
+		 com_err(progname, EINVAL,
 			  "for container reference while creating realm '%s'",
 			   global_params.realm);
 		 goto err_nomsg;
@@ -401,7 +401,7 @@ void kdb5_ldap_create(argc, argv)
 		rparams->search_scope = atoi(argv[i]);
 		if ((rparams->search_scope != 1) &&
 		    (rparams->search_scope != 2)) {
-		    com_err(argv[0], EINVAL,
+		    com_err(progname, EINVAL,
 			    "invalid search scope while creating realm '%s'",
 			    global_params.realm);
 		    goto err_nomsg;
@@ -498,7 +498,7 @@ void kdb5_ldap_create(argc, argv)
 	retval = krb5_read_password(util_context, KRB5_KDC_MKEY_1, KRB5_KDC_MKEY_2,
 				    pw_str, &pw_size);
 	if (retval) {
-	    com_err(argv[0], retval, "while reading master key from keyboard");
+	    com_err(progname, retval, "while reading master key from keyboard");
 	    goto err_nomsg;
 	}
 	mkey_password = pw_str;
@@ -516,7 +516,7 @@ void kdb5_ldap_create(argc, argv)
     rparams->realm_name = strdup(global_params.realm);
     if (rparams->realm_name == NULL) {
 	retval = ENOMEM;
-	com_err(argv[0], ENOMEM, "while creating realm '%s'",
+	com_err(progname, ENOMEM, "while creating realm '%s'",
 		global_params.realm);
 	goto err_nomsg;
     }
@@ -588,11 +588,11 @@ void kdb5_ldap_create(argc, argv)
 	retval = krb5_ldap_read_krbcontainer_params(util_context,
 						    &(ldap_context->krbcontainer));
 	if (retval) {
-	    com_err(argv[0], retval, "while reading kerberos container information");
+	    com_err(progname, retval, "while reading kerberos container information");
 	    goto cleanup;
 	}
     } else if (retval) {
-	com_err(argv[0], retval, "while reading kerberos container information");
+	com_err(progname, retval, "while reading kerberos container information");
 	goto cleanup;
     }
 
@@ -608,7 +608,7 @@ void kdb5_ldap_create(argc, argv)
 					      global_params.realm,
 					      &(ldap_context->lrparams),
 					      &mask))) {
-	com_err(argv[0], retval, "while reading information of realm '%s'",
+	com_err(progname, retval, "while reading information of realm '%s'",
 		global_params.realm);
 	goto err_nomsg;
     }
@@ -623,7 +623,7 @@ void kdb5_ldap_create(argc, argv)
 					  global_params.mkey_name,
 					  global_params.realm,
 					  0, &master_princ))) {
-	com_err(argv[0], retval, "while setting up master key name");
+	com_err(progname, retval, "while setting up master key name");
 	goto err_nomsg;
     }
 
@@ -635,7 +635,7 @@ void kdb5_ldap_create(argc, argv)
 	pwd.length = strlen(mkey_password);
 	retval = krb5_principal2salt(util_context, master_princ, &master_salt);
 	if (retval) {
-	    com_err(argv[0], retval, "while calculating master key salt");
+	    com_err(progname, retval, "while calculating master key salt");
 	    goto err_nomsg;
 	}
 
@@ -646,7 +646,7 @@ void kdb5_ldap_create(argc, argv)
 	    free(master_salt.data);
 
 	if (retval) {
-	    com_err(argv[0], retval, "while transforming master key from password");
+	    com_err(progname, retval, "while transforming master key from password");
 	    goto err_nomsg;
 	}
 
@@ -689,28 +689,28 @@ void kdb5_ldap_create(argc, argv)
 	/* Create 'K/M' ... */
 	rblock.flags |= KRB5_KDB_DISALLOW_ALL_TIX;
 	if ((retval = kdb_ldap_create_principal(util_context, master_princ, MASTER_KEY, &rblock))) {
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 
 	/* Create 'krbtgt' ... */
 	rblock.flags = 0; /* reset the flags */
 	if ((retval = kdb_ldap_create_principal(util_context, &tgt_princ, TGT_KEY, &rblock))) {
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 
 	/* Create 'kadmin/admin' ... */
 	snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_ADMIN_SERVICE, global_params.realm);
 	if ((retval = krb5_parse_name(util_context, princ_name, &p))) {
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 	rblock.max_life = ADMIN_LIFETIME;
 	rblock.flags = KRB5_KDB_DISALLOW_TGT_BASED;
 	if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY, &rblock))) {
 	    krb5_free_principal(util_context, p);
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 	krb5_free_principal(util_context, p);
@@ -718,7 +718,7 @@ void kdb5_ldap_create(argc, argv)
 	/* Create 'kadmin/changepw' ... */
 	snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_CHANGEPW_SERVICE, global_params.realm);
 	if ((retval = krb5_parse_name(util_context, princ_name, &p))) {
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 	rblock.max_life = CHANGEPW_LIFETIME;
@@ -726,7 +726,7 @@ void kdb5_ldap_create(argc, argv)
 	    KRB5_KDB_PWCHANGE_SERVICE;
 	if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY, &rblock))) {
 	    krb5_free_principal(util_context, p);
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 	krb5_free_principal(util_context, p);
@@ -734,26 +734,26 @@ void kdb5_ldap_create(argc, argv)
 	/* Create 'kadmin/history' ... */
 	snprintf(princ_name, sizeof(princ_name), "%s@%s", KADM5_HIST_PRINCIPAL, global_params.realm);
 	if ((retval = krb5_parse_name(util_context, princ_name, &p))) {
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 	rblock.max_life = global_params.max_life;
 	rblock.flags = 0;
 	if ((retval = kdb_ldap_create_principal(util_context, p, TGT_KEY, &rblock))) {
 	    krb5_free_principal(util_context, p);
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 	krb5_free_principal(util_context, p);
 
 	/* Create 'kadmin/<hostname>' ... */
 	if ((retval=krb5_sname_to_principal(util_context, NULL, "kadmin", KRB5_NT_SRV_HST, &p))) {
-	    com_err(argv[0], retval, "krb5_sname_to_principal, while adding entries to the database");
+	    com_err(progname, retval, "krb5_sname_to_principal, while adding entries to the database");
 	    goto err_nomsg;
 	}
 
 	if ((retval=krb5_copy_principal(util_context, p, &temp_p))) {
-	    com_err(argv[0], retval, "krb5_copy_principal, while adding entries to the database");
+	    com_err(progname, retval, "krb5_copy_principal, while adding entries to the database");
 	    goto err_nomsg;
 	}
 
@@ -762,7 +762,7 @@ void kdb5_ldap_create(argc, argv)
 	temp_p->realm.length = strlen(util_context->default_realm);
 	temp_p->realm.data = strdup(util_context->default_realm);
 	if (temp_p->realm.data == NULL) {
-	    com_err(argv[0], ENOMEM, "while adding entries to the database");
+	    com_err(progname, ENOMEM, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 
@@ -770,7 +770,7 @@ void kdb5_ldap_create(argc, argv)
 	rblock.flags = KRB5_KDB_DISALLOW_TGT_BASED;
 	if ((retval = kdb_ldap_create_principal(util_context, temp_p, TGT_KEY, &rblock))) {
 	    krb5_free_principal(util_context, p);
-	    com_err(argv[0], retval, "while adding entries to the database");
+	    com_err(progname, retval, "while adding entries to the database");
 	    goto err_nomsg;
 	}
 	krb5_free_principal(util_context, temp_p);
@@ -798,7 +798,7 @@ void kdb5_ldap_create(argc, argv)
 							 LDAP_KDC_SERVICE, rparams->kdcservers[i],
 							 rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
 		    printf("failed\n");
-		    com_err(argv[0], retval, "while assigning rights to '%s'",
+		    com_err(progname, retval, "while assigning rights to '%s'",
 			    rparams->realm_name);
 		    goto err_nomsg;
 		}
@@ -814,7 +814,7 @@ void kdb5_ldap_create(argc, argv)
 							 LDAP_ADMIN_SERVICE, rparams->adminservers[i],
 							 rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
 		    printf("failed\n");
-		    com_err(argv[0], retval, "while assigning rights to '%s'",
+		    com_err(progname, retval, "while assigning rights to '%s'",
 			    rparams->realm_name);
 		    goto err_nomsg;
 		}
@@ -830,7 +830,7 @@ void kdb5_ldap_create(argc, argv)
 							 LDAP_PASSWD_SERVICE, rparams->passwdservers[i],
 							 rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
 		    printf("failed\n");
-		    com_err(argv[0], retval, "while assigning rights to '%s'",
+		    com_err(progname, retval, "while assigning rights to '%s'",
 			    rparams->realm_name);
 		    goto err_nomsg;
 		}
@@ -850,7 +850,7 @@ void kdb5_ldap_create(argc, argv)
 				     master_princ,
 				     &master_keyblock, NULL);
 	if (retval) {
-	    com_err(argv[0], errno, "while storing key");
+	    com_err(progname, errno, "while storing key");
 	    printf("Warning: couldn't stash master key.\n");
 	}
     }
@@ -879,7 +879,7 @@ cleanup:
 
     if (retval) {
 	if (!no_msg) {
-	    com_err(argv[0], retval, "while creating realm '%s'",
+	    com_err(progname, retval, "while creating realm '%s'",
 		    global_params.realm);
 	}
 	exit_status++;
@@ -932,7 +932,7 @@ void kdb5_ldap_modify(argc, argv)
 
     if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
 						     &(ldap_context->krbcontainer)))) {
-	com_err(argv[0], retval, "while reading Kerberos container information");
+	com_err(progname, retval, "while reading Kerberos container information");
 	goto err_nomsg;
     }
 
@@ -986,7 +986,7 @@ void kdb5_ldap_modify(argc, argv)
 		rparams->subtree =  slist;
 	    } else if(strncmp(argv[i], "", strlen(argv[i]))==0) {
 		 /* dont allow subtree value to be set at the root(NULL, "") of the tree */
-		    com_err(argv[0], EINVAL,
+		    com_err(progname, EINVAL,
 			    "for subtree while modifying realm '%s'",
 			    global_params.realm);
 		    goto err_nomsg;
@@ -998,7 +998,7 @@ void kdb5_ldap_modify(argc, argv)
 		goto err_usage;
 	    if(strncmp(argv[i], "", strlen(argv[i]))==0) {
 		 /* dont allow containerref value to be set at the root(NULL, "") of the tree */
-		 com_err(argv[0], EINVAL,
+		 com_err(progname, EINVAL,
 			  "for container reference while modifying realm '%s'",
 			   global_params.realm);
 		 goto err_nomsg;
@@ -1024,7 +1024,7 @@ void kdb5_ldap_modify(argc, argv)
 		if ((rparams->search_scope != 1) &&
 		    (rparams->search_scope != 2)) {
 		    retval = EINVAL;
-		    com_err(argv[0], retval,
+		    com_err(progname, retval,
 			    "specified for search scope while modifying information of realm '%s'",
 			    global_params.realm);
 		    goto err_nomsg;
@@ -1529,7 +1529,7 @@ void kdb5_ldap_modify(argc, argv)
 								LDAP_KDC_SERVICE, oldkdcdns[i],
 								rparams->realm_name, oldsubtrees, rightsmask)) != 0) {
 			printf("failed\n");
-			com_err(argv[0], retval, "while assigning rights '%s'",
+			com_err(progname, retval, "while assigning rights '%s'",
 				rparams->realm_name);
 			goto err_nomsg;
 		    }
@@ -1546,7 +1546,7 @@ void kdb5_ldap_modify(argc, argv)
 							     LDAP_KDC_SERVICE, newkdcdns[i], rparams->realm_name,
 							     rparams->subtree, rightsmask)) != 0) {
 			printf("failed\n");
-			com_err(argv[0], retval, "while assigning rights to '%s'",
+			com_err(progname, retval, "while assigning rights to '%s'",
 				rparams->realm_name);
 			goto err_nomsg;
 		    }
@@ -1608,7 +1608,7 @@ void kdb5_ldap_modify(argc, argv)
 								LDAP_ADMIN_SERVICE, oldadmindns[i],
 								rparams->realm_name, oldsubtrees, rightsmask)) != 0) {
 			printf("failed\n");
-			com_err(argv[0], retval, "while assigning rights '%s'",
+			com_err(progname, retval, "while assigning rights '%s'",
 				rparams->realm_name);
 			goto err_nomsg;
 		    }
@@ -1626,7 +1626,7 @@ void kdb5_ldap_modify(argc, argv)
 							     LDAP_ADMIN_SERVICE, newadmindns[i],
 							     rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
 			printf("failed\n");
-			com_err(argv[0], retval, "while assigning rights to '%s'",
+			com_err(progname, retval, "while assigning rights to '%s'",
 				rparams->realm_name);
 			goto err_nomsg;
 		    }
@@ -1688,7 +1688,7 @@ void kdb5_ldap_modify(argc, argv)
 								  LDAP_PASSWD_SERVICE, oldpwddns[i],
 								  rparams->realm_name, oldsubtrees, rightsmask))) {
 			printf("failed\n");
-			com_err(argv[0], retval, "while assigning rights '%s'",
+			com_err(progname, retval, "while assigning rights '%s'",
 				rparams->realm_name);
 			goto err_nomsg;
 		    }
@@ -1705,7 +1705,7 @@ void kdb5_ldap_modify(argc, argv)
 							       LDAP_PASSWD_SERVICE, newpwddns[i],
 							       rparams->realm_name, rparams->subtree, rightsmask))) {
 			printf("failed\n");
-			com_err(argv[0], retval, "while assigning rights to '%s'",
+			com_err(progname, retval, "while assigning rights to '%s'",
 				rparams->realm_name);
 			goto err_nomsg;
 		    }
@@ -1777,7 +1777,7 @@ cleanup:
 
     if (retval) {
 	if (!no_msg)
-	    com_err(argv[0], retval, "while modifying information of realm '%s'",
+	    com_err(progname, retval, "while modifying information of realm '%s'",
 		    global_params.realm);
 	exit_status++;
     }
@@ -1804,7 +1804,7 @@ void kdb5_ldap_view(argc, argv)
     ldap_context = (krb5_ldap_context *) dal_handle->db_context;
     if (!(ldap_context)) {
 	retval = EINVAL;
-	com_err(argv[0], retval, "while initializing database");
+	com_err(progname, retval, "while initializing database");
 	exit_status++;
 	return;
     }
@@ -1812,14 +1812,14 @@ void kdb5_ldap_view(argc, argv)
     /* Read the kerberos container information */
     if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
 						     &(ldap_context->krbcontainer))) != 0) {
-	com_err(argv[0], retval, "while reading kerberos container information");
+	com_err(progname, retval, "while reading kerberos container information");
 	exit_status++;
 	return;
     }
 
     if ((retval = krb5_ldap_read_realm_params(util_context,
 					      global_params.realm, &rparams, &mask)) || (!rparams)) {
-	com_err(argv[0], retval, "while reading information of realm '%s'",
+	com_err(progname, retval, "while reading information of realm '%s'",
 		global_params.realm);
 	exit_status++;
 	return;
@@ -2009,7 +2009,7 @@ void kdb5_ldap_list(argc, argv)
     /* Read the kerberos container information */
     if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
 						     &(ldap_context->krbcontainer))) != 0) {
-	com_err(argv[0], retval, "while reading kerberos container information");
+	com_err(progname, retval, "while reading kerberos container information");
 	exit_status++;
 	return;
     }
@@ -2018,7 +2018,7 @@ void kdb5_ldap_list(argc, argv)
     if (retval != 0) {
 	krb5_ldap_free_krbcontainer_params(ldap_context->krbcontainer);
 	ldap_context->krbcontainer = NULL;
-	com_err (argv[0], retval, "while listing realms");
+	com_err (progname, retval, "while listing realms");
 	exit_status++;
 	return;
     }
@@ -2434,7 +2434,7 @@ kdb5_ldap_destroy(argc, argv)
     dal_handle = (kdb5_dal_handle *)util_context->db_context;
     ldap_context = (krb5_ldap_context *) dal_handle->db_context;
     if (!(ldap_context)) {
-	com_err(argv[0], EINVAL, "while initializing database");
+	com_err(progname, EINVAL, "while initializing database");
 	exit_status++;
 	return;
     }
@@ -2442,7 +2442,7 @@ kdb5_ldap_destroy(argc, argv)
     /* Read the kerberos container from the LDAP Server */
     if ((retval = krb5_ldap_read_krbcontainer_params(util_context,
 						     &(ldap_context->krbcontainer))) != 0) {
-	com_err(argv[0], retval, "while reading kerberos container information");
+	com_err(progname, retval, "while reading kerberos container information");
 	exit_status++;
 	return;
     }
@@ -2450,7 +2450,7 @@ kdb5_ldap_destroy(argc, argv)
     /* Read the Realm information from the LDAP Server */
     if ((retval = krb5_ldap_read_realm_params(util_context, global_params.realm,
 					      &(ldap_context->lrparams), &mask)) != 0) {
-	com_err(argv[0], retval, "while reading realm information");
+	com_err(progname, retval, "while reading realm information");
 	exit_status++;
 	return;
     }
@@ -2472,7 +2472,7 @@ kdb5_ldap_destroy(argc, argv)
 							      LDAP_KDC_SERVICE, rparams->kdcservers[i],
 							      rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
 		    printf("failed\n");
-		    com_err(argv[0], retval, "while assigning rights to '%s'",
+		    com_err(progname, retval, "while assigning rights to '%s'",
 			    rparams->realm_name);
 		    return;
 		}
@@ -2487,7 +2487,7 @@ kdb5_ldap_destroy(argc, argv)
 							      LDAP_ADMIN_SERVICE, rparams->adminservers[i],
 							      rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
 		    printf("failed\n");
-		    com_err(argv[0], retval, "while assigning rights to '%s'",
+		    com_err(progname, retval, "while assigning rights to '%s'",
 			    rparams->realm_name);
 		    return;
 		}
@@ -2502,7 +2502,7 @@ kdb5_ldap_destroy(argc, argv)
 							      LDAP_PASSWD_SERVICE, rparams->passwdservers[i],
 							      rparams->realm_name, rparams->subtree, rightsmask)) != 0) {
 		    printf("failed\n");
-		    com_err(argv[0], retval, "while assigning rights to '%s'",
+		    com_err(progname, retval, "while assigning rights to '%s'",
 			    rparams->realm_name);
 		    return;
 		}
@@ -2514,7 +2514,7 @@ kdb5_ldap_destroy(argc, argv)
     /* Delete the realm container and all the associated principals */
     retval = krb5_ldap_delete_realm(util_context, global_params.realm);
     if (retval) {
-	com_err(argv[0], retval, "deleting database of '%s'", global_params.realm);
+	com_err(progname, retval, "deleting database of '%s'", global_params.realm);
 	exit_status++;
 	return;
     }
Index: src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.h
===================================================================
--- src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.h.orig
+++ src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.h
@@ -58,6 +58,8 @@
 #define DESTROY_POLICY        14
 #define LIST_POLICY           15
 
+extern char *progname;
+
 extern int exit_status;
 extern krb5_context util_context;
 
Index: src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
===================================================================
--- src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c.orig
+++ src/plugins/kdb/ldap/ldap_util/kdb5_ldap_services.c
@@ -198,7 +198,7 @@ void kdb5_ldap_create_service(argc, argv
     int argc;
     char *argv[];
 {
-    char *me = argv[0];
+    char *me = progname;
     krb5_error_code retval = 0;
     krb5_ldap_service_params *srvparams = NULL;
     krb5_boolean print_usage = FALSE;
@@ -496,7 +496,7 @@ void kdb5_ldap_modify_service(argc, argv
     int argc;
     char *argv[];
 {
-    char *me = argv[0];
+    char *me = progname; 
     krb5_error_code retval = 0;
     krb5_ldap_service_params *srvparams = NULL;
     krb5_boolean print_usage = FALSE;
@@ -569,7 +569,7 @@ void kdb5_ldap_modify_service(argc, argv
 
     retval = krb5_ldap_read_service(util_context, servicedn, &srvparams, &in_mask);
     if (retval) {
-	com_err(argv[0], retval, "while reading information of service '%s'",
+	com_err(me, retval, "while reading information of service '%s'",
 		servicedn);
 	goto err_nomsg;
     }
@@ -1061,7 +1061,7 @@ rem_service_entry_from_file(argc, argv,
     char *service_object;
 {
     int     st        = EINVAL;
-    char    *me       = argv[0];
+    char    *me       = progname;
     char    *tmp_file = NULL;
     int     tmpfd     = -1;
     FILE    *pfile    = NULL;
@@ -1175,7 +1175,7 @@ kdb5_ldap_destroy_service(argc, argv)
 	    if (argv[i+1]) {
 		stashfilename=strdup(argv[i+1]);
 		if (stashfilename == NULL) {
-		    com_err(argv[0], ENOMEM, "while destroying service");
+		    com_err(progname, ENOMEM, "while destroying service");
 		    exit_status++;
 		    goto cleanup;
 		}
@@ -1188,7 +1188,7 @@ kdb5_ldap_destroy_service(argc, argv)
 	    if ((argv[i]) && (servicedn == NULL)) {
 		servicedn=strdup(argv[i]);
 		if (servicedn == NULL) {
-		    com_err(argv[0], ENOMEM, "while destroying service");
+		    com_err(progname, ENOMEM, "while destroying service");
 		    exit_status++;
 		    goto cleanup;
 		}
@@ -1219,7 +1219,7 @@ kdb5_ldap_destroy_service(argc, argv)
 
     if ((retval = krb5_ldap_read_service(util_context, servicedn,
 					 &lserparams, &mask))) {
-	com_err(argv[0], retval, "while destroying service '%s'",servicedn);
+	com_err(progname, retval, "while destroying service '%s'",servicedn);
 	exit_status++;
 	goto cleanup;
     }
@@ -1227,7 +1227,7 @@ kdb5_ldap_destroy_service(argc, argv)
     retval = krb5_ldap_delete_service(util_context, lserparams, servicedn);
 
     if (retval) {
-	com_err(argv[0], retval, "while destroying service '%s'", servicedn);
+	com_err(progname, retval, "while destroying service '%s'", servicedn);
 	exit_status++;
 	goto cleanup;
     }
@@ -1235,7 +1235,7 @@ kdb5_ldap_destroy_service(argc, argv)
     if (stashfilename == NULL) {
 	stashfilename = strdup(DEF_SERVICE_PASSWD_FILE);
 	if (stashfilename == NULL) {
-	    com_err(argv[0], ENOMEM, "while destroying service");
+	    com_err(progname, ENOMEM, "while destroying service");
 	    exit_status++;
 	    goto cleanup;
 	}
@@ -1295,13 +1295,13 @@ void kdb5_ldap_view_service(argc, argv)
 
     servicedn=strdup(argv[1]);
     if (servicedn == NULL) {
-	com_err(argv[0], ENOMEM, "while viewing service");
+	com_err(progname, ENOMEM, "while viewing service");
 	exit_status++;
 	goto cleanup;
     }
 
     if ((retval = krb5_ldap_read_service(util_context, servicedn, &lserparams, &mask))) {
-	com_err(argv[0], retval, "while viewing service '%s'",servicedn);
+	com_err(progname, retval, "while viewing service '%s'",servicedn);
 	exit_status++;
 	goto cleanup;
     }
@@ -1338,7 +1338,7 @@ void kdb5_ldap_list_services(argc, argv)
     int argc;
     char *argv[];
 {
-    char *me = argv[0];
+    char *me = progname;
     krb5_error_code retval = 0;
     char *basedn = NULL;
     char **list = NULL;
@@ -1519,7 +1519,7 @@ kdb5_ldap_set_service_password(argc, arg
     krb5_ldap_context *lparams = NULL;
     char *file_name = NULL;
     char *tmp_file = NULL;
-    char *me = argv[0];
+    char *me = progname;
     int filelen = 0;
     int random_passwd = 0;
     int set_dir_pwd = 1;
@@ -1902,7 +1902,7 @@ kdb5_ldap_stash_service_password(argc, a
 {
     int ret = 0;
     unsigned int passwd_len = 0;
-    char *me = argv[0];
+    char *me = progname;
     char *service_object = NULL;
     char *file_name = NULL, *tmp_file = NULL;
     char passwd[MAX_SERVICE_PASSWD_LEN];
Index: src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.M
===================================================================
--- src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.M.orig
+++ src/plugins/kdb/ldap/ldap_util/kdb5_ldap_util.M
@@ -73,7 +73,7 @@ set. This means all the ticket options w
 The various flags are:
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_postdated\fP
-.B -allow_postdated
+.B \-allow_postdated
 prohibits principals from obtaining postdated tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_POSTDATED
 flag.)
@@ -81,7 +81,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_forwardable\fP
-.B -allow_forwardable
+.B \-allow_forwardable
 prohibits principals from obtaining forwardable tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_FORWARDABLE
 flag.)
@@ -89,7 +89,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_renewable\fP
-.B -allow_renewable
+.B \-allow_renewable
 prohibits principals from obtaining renewable tickets. (Sets the
 .SM KRB5_KDB_DISALLOW_RENEWABLE
 flag.)
@@ -97,7 +97,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_proxiable\fP
-.B -allow_proxiable
+.B \-allow_proxiable
 prohibits principals from obtaining proxiable tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_PROXIABLE
 flag.)
@@ -105,7 +105,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_dup_skey\fP
-.B -allow_dup_skey
+.B \-allow_dup_skey
 Disables user-to-user authentication for principals by prohibiting
 principals from obtaining a session key for another user. (Sets the
 .SM KRB5_KDB_DISALLOW_DUP_SKEY
@@ -119,7 +119,7 @@ requires principals to preauthenticate b
 kinit.  (Sets the
 .SM KRB5_KDB_REQUIRES_PRE_AUTH
 flag.)
-.B -requires_preauth
+.B \-requires_preauth
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBrequires_hwauth\fP
@@ -128,11 +128,11 @@ requires principals to preauthenticate u
 before being allowed to kinit.  (Sets the
 .SM KRB5_KDB_REQUIRES_HW_AUTH
 flag.)
-.B -requires_hwauth
+.B \-requires_hwauth
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_svr\fP
-.B -allow_svr
+.B \-allow_svr
 prohibits the issuance of service tickets for principals.  (Sets the
 .SM KRB5_KDB_DISALLOW_SVR
 flag.)
@@ -208,9 +208,9 @@ Specifies the list of Administration ser
 of the Administration service objects separated by colon(:).
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu
-create -subtrees o=org -sscope SUB
--r ATHENA.MIT.EDU\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu
+create \-subtrees o=org \-sscope SUB
+\-r ATHENA.MIT.EDU\fP
 .nf
 Password for "cn=admin,o=org":
 Initializing database for realm 'ATHENA.MIT.EDU'
@@ -255,7 +255,7 @@ and no restriction will be set.
 The various flags are:
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_postdated\fP
-.B -allow_postdated
+.B \-allow_postdated
 prohibits principals from obtaining postdated tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_POSTDATED
 flag.)
@@ -263,7 +263,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_forwardable\fP
-.B -allow_forwardable
+.B \-allow_forwardable
 prohibits principals from obtaining forwardable tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_FORWARDABLE
 flag.)
@@ -271,7 +271,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_renewable\fP
-.B -allow_renewable
+.B \-allow_renewable
 prohibits principals from obtaining renewable tickets. (Sets the
 .SM KRB5_KDB_DISALLOW_RENEWABLE
 flag.)
@@ -279,7 +279,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_proxiable\fP
-.B -allow_proxiable
+.B \-allow_proxiable
 prohibits principals from obtaining proxiable tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_PROXIABLE
 flag.)
@@ -287,7 +287,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_dup_skey\fP
-.B -allow_dup_skey
+.B \-allow_dup_skey
 Disables user-to-user authentication for principals by prohibiting
 principals from obtaining a session key for another user. (Sets the
 .SM KRB5_KDB_DISALLOW_DUP_SKEY
@@ -301,7 +301,7 @@ requires principals to preauthenticate b
 kinit.  (Sets the
 .SM KRB5_KDB_REQUIRES_PRE_AUTH
 flag.)
-.B -requires_preauth
+.B \-requires_preauth
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBrequires_hwauth\fP
@@ -310,11 +310,11 @@ requires principals to preauthenticate u
 before being allowed to kinit.  (Sets the
 .SM KRB5_KDB_REQUIRES_HW_AUTH
 flag.)
-.B -requires_hwauth
+.B \-requires_hwauth
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_svr\fP
-.B -allow_svr
+.B \-allow_svr
 prohibits the issuance of service tickets for principals.  (Sets the
 .SM KRB5_KDB_DISALLOW_SVR
 flag.)
@@ -406,8 +406,8 @@ Specifies the list of Administration ser
 contains the DNs of the Administration service objects separated by a colon (:).
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu modify 
-+requires_preauth -r ATHENA.MIT.EDU \fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu modify 
++requires_preauth \-r ATHENA.MIT.EDU \fP
 .nf
 Password for "cn=admin,o=org":
 .fi
@@ -423,8 +423,8 @@ Specifies the Kerberos realm of the data
 is used.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu view 
--r ATHENA.MIT.EDU\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu view 
+\-r ATHENA.MIT.EDU\fP
 .nf
 Password for "cn=admin,o=org":
                Realm Name: ATHENA.MIT.EDU
@@ -450,8 +450,8 @@ Specifies the Kerberos realm of the data
 is used.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu destroy 
--r ATHENA.MIT.EDU\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu destroy 
+\-r ATHENA.MIT.EDU\fP
 .nf
 Password for "cn=admin,o=org":
 Deleting KDC database of 'ATHENA.MIT.EDU', are you sure?
@@ -467,7 +467,7 @@ Lists the name of realms.
 .nf
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu list\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu list\fP
 Password for "cn=admin,o=org":
 ATHENA.MIT.EDU
 OPENLDAP.MIT.EDU
@@ -487,7 +487,7 @@ Specifies the complete path of the servi
 Specifies Distinguished name (DN) of the service object whose password is to be stored in file.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util stashsrvpw -f /home/andrew/conf_keyfile cn=service-kdc,o=org\fP
+\fBkdb5_ldap_util stashsrvpw \-f /home/andrew/conf_keyfile cn=service-kdc,o=org\fP
 .nf
 Password for "cn=service-kdc,o=org":
 Re-enter password for "cn=service-kdc,o=org":
@@ -517,7 +517,7 @@ set. This means all the ticket options w
 The various flags are:
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_postdated\fP
-.B -allow_postdated
+.B \-allow_postdated
 prohibits principals from obtaining postdated tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_POSTDATED
 flag.)
@@ -525,7 +525,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_forwardable\fP
-.B -allow_forwardable
+.B \-allow_forwardable
 prohibits principals from obtaining forwardable tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_FORWARDABLE
 flag.)
@@ -533,7 +533,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_renewable\fP
-.B -allow_renewable
+.B \-allow_renewable
 prohibits principals from obtaining renewable tickets. (Sets the
 .SM KRB5_KDB_DISALLOW_RENEWABLE
 flag.)
@@ -541,7 +541,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_proxiable\fP
-.B -allow_proxiable
+.B \-allow_proxiable
 prohibits principals from obtaining proxiable tickets.  (Sets the
 .SM KRB5_KDB_DISALLOW_PROXIABLE
 flag.)
@@ -549,7 +549,7 @@ flag.)
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_dup_skey\fP
-.B -allow_dup_skey
+.B \-allow_dup_skey
 Disables user-to-user authentication for principals by prohibiting
 principals from obtaining a session key for another user. (Sets the
 .SM KRB5_KDB_DISALLOW_DUP_SKEY
@@ -563,7 +563,7 @@ requires principals to preauthenticate b
 kinit.  (Sets the
 .SM KRB5_KDB_REQUIRES_PRE_AUTH
 flag.)
-.B -requires_preauth
+.B \-requires_preauth
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBrequires_hwauth\fP
@@ -572,11 +572,11 @@ requires principals to preauthenticate u
 before being allowed to kinit.  (Sets the
 .SM KRB5_KDB_REQUIRES_HW_AUTH
 flag.)
-.B -requires_hwauth
+.B \-requires_hwauth
 clears this flag.
 .TP
 {\fB\-\fP|\fB+\fP}\fBallow_svr\fP
-.B -allow_svr
+.B \-allow_svr
 prohibits the issuance of service tickets for principals.  (Sets the
 .SM KRB5_KDB_DISALLOW_SVR
 flag.)
@@ -639,7 +639,7 @@ flag on principals in the database.
 Specifies the name of the ticket policy.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu create_policy -r ATHENA.MIT.EDU -maxtktlife "1 day" -maxrenewlife "1 week" -allow_postdated +needchange -allow_forwardable tktpolicy\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu create_policy \-r ATHENA.MIT.EDU \-maxtktlife "1 day" \-maxrenewlife "1 week" \-allow_postdated +needchange \-allow_forwardable tktpolicy\fP
 .nf
 Password for "cn=admin,o=org":
 .fi
@@ -657,7 +657,7 @@ returned by
 is used.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu modify_policy -r ATHENA.MIT.EDU -maxtktlife "60 minutes" -maxrenewlife "10 hours" +allow_postdated -requires_preauth tktpolicy\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu modify_policy \-r ATHENA.MIT.EDU \-maxtktlife "60 minutes" \-maxrenewlife "10 hours" +allow_postdated \-requires_preauth tktpolicy\fP
 .nf
 Password for "cn=admin,o=org":
 .fi
@@ -671,7 +671,7 @@ Displays the attributes of a ticket poli
 Specifies the name of the ticket policy.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu view_policy -r ATHENA.MIT.EDU tktpolicy\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu view_policy \-r ATHENA.MIT.EDU tktpolicy\fP
 .nf
 Password for "cn=admin,o=org":
             Ticket policy: tktpolicy
@@ -700,7 +700,7 @@ to confirm the deletion.
 Specifies the name of the ticket policy.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu destroy_policy -r ATHENA.MIT.EDU tktpolicy\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu destroy_policy \-r ATHENA.MIT.EDU tktpolicy\fP
 .nf
 Password for "cn=admin,o=org":
 This will delete the policy object 'tktpolicy', are you sure?
@@ -720,7 +720,7 @@ returned by
 is used.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu list_policy -r ATHENA.MIT.EDU\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org \-H ldaps://ldap-server1.mit.edu list_policy \-r ATHENA.MIT.EDU\fP
 .nf
 Password for "cn=admin,o=org":
 tktpolicy
@@ -735,22 +735,22 @@ userpolicy
 \fBsetsrvpw\fP [\fB\-randpw\fP|\fB\-fileonly\fP] [\fB\-f\fP\ \fIfilename\fP] \fIservice_dn\fP
 Allows an administrator to set password for service objects such as KDC and Administration server in
 eDirectory and store them in a file. The 
-.I -fileonly 
+.I \-fileonly 
 option stores the password in a file and not in the eDirectory object. Options:
 .RS
 .TP
 \fB\-randpw \fP
 Generates and sets a random password. This options can be specified to store the password both in eDirectory and a file. The 
-.I -fileonly 
+.I \-fileonly 
 option can not be used if 
-.I -randpw
+.I \-randpw
 option is already specified.
 .TP
 \fB\-fileonly\fP
 Stores the password only in a file and not in eDirectory. The 
-.I -randpw
+.I \-randpw
 option can not be used when 
-.I -fileonly
+.I \-fileonly
 options is specified.
 .TP
 \fB\-f\fP\ \fIfilename\fP
@@ -760,7 +760,7 @@ Specifies complete path of the service p
 Specifies Distinguished name (DN) of the service object whose password is to be set.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util setsrvpw -D cn=admin,o=org setsrvpw -fileonly -f /home/andrew/conf_keyfile
+\fBkdb5_ldap_util setsrvpw \-D cn=admin,o=org setsrvpw \-fileonly \-f /home/andrew/conf_keyfile
 cn=service-kdc,o=org\fP
 .nf
 Password for "cn=admin,o=org":
@@ -792,16 +792,16 @@ separated by a colon (:).
 .TP
 \fB\-randpw \fP
 Generates and sets a random password. This option is used to set the random password for the service object in directory and also to store it in the file. The 
-.I -fileonly 
+.I \-fileonly 
 option can not be used if 
-.I -randpw
+.I \-randpw
 option is specified.
 .TP
 \fB\-fileonly\fP
 Stores the password only in a file and not in eDirectory. The 
-.I -randpw
+.I \-randpw
 option can not be used when 
-.I -fileonly
+.I \-fileonly
 option is specified.
 .TP
 \fB\-f\fP\ \fIfilename\fP
@@ -811,7 +811,7 @@ Specifies the complete path of the file
 Specifies Distinguished name (DN) of the Kerberos service to be created.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org create_service -kdc -randpw -f /home/andrew/conf_keyfile cn=service-kdc,o=org\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org create_service \-kdc \-randpw \-f /home/andrew/conf_keyfile cn=service-kdc,o=org\fP
 .nf
 Password for "cn=admin,o=org":
 File does not exist. Creating the file /home/andrew/conf_keyfile...
@@ -855,7 +855,7 @@ realms separated by a colon (:).
 Specifies Distinguished name (DN) of the Kerberos service to be modified.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org modify_service -realm ATHENA.MIT.EDU
+\fBkdb5_ldap_util \-D cn=admin,o=org modify_service \-realm ATHENA.MIT.EDU
 cn=service-kdc,o=org\fP
 .nf
 Password for "cn=admin,o=org":
@@ -871,7 +871,7 @@ Displays the attributes of a service.  O
 Specifies Distinguished name (DN) of the Kerberos service to be viewed.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org view_service cn=service-kdc,o=org\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org view_service cn=service-kdc,o=org\fP
 .nf
 Password for "cn=admin,o=org":
         Service dn: cn=service-kdc,o=org
@@ -897,7 +897,7 @@ needs to be removed.
 Specifies Distinguished name (DN) of the Kerberos service to be destroyed.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org destroy_service cn=service-kdc,o=org\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org destroy_service cn=service-kdc,o=org\fP
 .nf
 Password for "cn=admin,o=org":
 This will delete the service object 'cn=service-kdc,o=org', are you sure?
@@ -922,7 +922,7 @@ for the base DN is
 .B Root.
 .TP
 EXAMPLE:
-\fBkdb5_ldap_util -D cn=admin,o=org list_service\fP
+\fBkdb5_ldap_util \-D cn=admin,o=org list_service\fP
 .nf
 Password for "cn=admin,o=org":
 cn=service-kdc,o=org
Index: src/plugins/kdb/db2/libdb2/test/run.test
===================================================================
--- src/plugins/kdb/db2/libdb2/test/run.test.orig
+++ src/plugins/kdb/db2/libdb2/test/run.test
@@ -34,7 +34,7 @@ main()
 	bindir=/bin/.
 
 	if [ $# -eq 0 ]; then
-		for t in 1 2 3 4 5 6 7 8 9 10 11 12 13 20; do
+		for t in 1 2 3 4 5 6 7 8 9 10 11 12 13 20 40 41; do
 			test$t
 		done
 	else
@@ -45,7 +45,7 @@ main()
 			[0-9]*)
 				test$1;;
 			btree)
-				for t in 1 2 3 7 8 9 10 12 13; do
+				for t in 1 2 3 7 8 9 10 12 13 40 41; do
 					test$t
 				done;;
 			hash)
@@ -743,4 +743,162 @@ bsize=$bsize ffactor=$ffactor nelem=2500
 	done
 }
 
+# Test for a weird page split condition where an insertion into index
+# 0 of a page that would cause the new item to be the only item on the
+# left page results in index 0 of the right page being erroneously
+# skipped; this only happens with one particular key+data length for
+# each page size.
+test40 () {
+	echo "Test 40: btree: page split on index 0"
+	e=:
+	for psize in 512 1024 2048 4096 8192; do
+		echo "    page size $psize"
+		kdsizes=`awk 'BEGIN {
+			psize = '$psize'; hsize = int(psize/2);
+			for (kdsize = hsize-40; kdsize <= hsize; kdsize++) {
+				print kdsize;
+			}
+		}' /dev/null`
+
+		# Use a series of keylen+datalen values in the right
+		# neighborhood to find the one that triggers the bug.
+		# We could compute the exact size that triggers the
+		# bug but this additional fuzz may be useful.
+
+		# Insert keys in reverse order to maximize the chances
+		# for a split on index 0.
+
+		for kdsize in $kdsizes; do
+			awk 'BEGIN {
+				kdsize = '$kdsize';
+				for (i = 8; i-- > 0; ) {
+					s = sprintf("a%03d:%09d", i, kdsize);
+					for (j = 0; j < kdsize-20; j++) {
+						s = s "x";
+					}
+					printf("p\nka%03d\nd%s\n", i, s);
+				}
+				print "o";
+			}' /dev/null > $TMP2
+			sed -n 's/^d//p' $TMP2 | sort > $TMP1
+			$PROG -o $TMP3 -i psize=$psize btree $TMP2
+			if (cmp -s $TMP1 $TMP3); then :
+			else
+				echo "test40: btree: page size $psize, \
+keylen+datalen=$kdsize failed"
+				e='exit 1'
+			fi
+		done
+	done
+	$e
+}
+
+# Extremely tricky test attempting to replicate some unusual database
+# corruption seen in the field: pieces of the database becoming
+# inaccessible to random access, sequential access, or both.  The
+# hypothesis is that at least some of these are triggered by the bug
+# in page splits on index 0 with a particular exact keylen+datalen.
+# (See Test 40.)  For psize=4096, this size is exactly 2024.
+
+# The order of operations here relies on very specific knowledge of
+# the internals of the btree access method in order to place records
+# at specific offsets in a page and to create certain keys on internal
+# pages.  The to-be-split page immediately prior to the bug-triggering
+# split has the following properties:
+#
+# * is not the leftmost leaf page
+# * key on the parent page is compares less than the key of the item
+#   on index 0
+# * triggering record's key also compares greater than the key on the
+#   parent page
+
+# Additionally, we prime the mpool LRU chain so that the head page on
+# the chain has the following properties:
+#
+# * record at index 0 is located where it will not get overwritten by
+#   items written to the right-hand page during the split
+# * key of the record at index 0 compares less than the key of the
+#   bug-triggering record
+
+# If the page-split bug exists, this test appears to create a database
+# where some records are inaccessible to a search, but still remain in
+# the file and are accessible by sequential traversal.  At least one
+# record gets duplicated out of sequence.
+
+test41 () {
+	echo "Test 41: btree: no unsearchables due to page split on index 0"
+	# list of individual retrievals in a variable for easy reuse
+	list=`(for i in a b c d; do
+			for j in 990 998 999; do
+				echo g ${i}${j} 1024
+			done
+		done;
+		echo g y997 2014
+		for i in y z; do
+			for j in 998 999; do
+				echo g ${i}${j} 1024
+			done
+		done)`
+	# Exact number for trigger condition accounts for newlines
+	# retained by dbtest with -ofile but not without; we use
+	# -ofile, so count newlines.  keylen=5,datalen=5+2014 for
+	# psize=4096 here.
+	(cat - <<EOF
+p z999 1024
+p z998 1024
+p y999 1024
+p y990 1024
+p d999 1024
+p d990 1024
+p c999 1024
+p c990 1024
+p b999 1024
+p b990 1024
+p a999 1024
+p a990 1024
+p y998 1024
+r y990
+p d998 1024
+p d990 1024
+p c998 1024
+p c990 1024
+p b998 1024
+p b990 1024
+p a998 1024
+p a990 1024
+p y997 2014
+S
+o
+EOF
+	echo "$list") |
+	# awk script input:
+	# {p|g|r} key [datasize]
+	awk '/^[pgr]/{
+		printf("%s\nk%s\n", $1, $2);
+	}
+	/^p/{
+		s = $2;
+		for (i = 0; i < $3; i++) {
+			s = s "x";
+		}
+		printf("d%s\n", s);
+	}
+	!/^[pgr]/{
+		print $0;
+	}' > $TMP2
+	(echo "$list"; echo "$list") | awk '{
+		s = $2;
+		for (i = 0; i < $3; i++) {
+			s = s "x";
+		}
+		print s;
+	}' > $TMP1
+	$PROG -o $TMP3 -i psize=4096 btree $TMP2
+	if (cmp -s $TMP1 $TMP3); then :
+	else
+		echo "test41: btree: failed"
+		exit 1
+	fi
+}
+
 main $*
Index: src/plugins/kdb/db2/libdb2/mpool/mpool.c
===================================================================
--- src/plugins/kdb/db2/libdb2/mpool/mpool.c.orig
+++ src/plugins/kdb/db2/libdb2/mpool/mpool.c
@@ -377,7 +377,7 @@ mpool_bkt(mp)
 			head = &mp->hqh[HASHKEY(bp->pgno)];
 			CIRCLEQ_REMOVE(head, bp, hq);
 			CIRCLEQ_REMOVE(&mp->lqh, bp, q);
-#ifdef DEBUG
+#if defined(DEBUG) && !defined(DEBUG_IDX0SPLIT)
 			{ void *spage;
 				spage = bp->page;
 				memset(bp, 0xff, sizeof(BKT) + mp->pagesize);
Index: src/plugins/kdb/db2/libdb2/btree/bt_debug.c
===================================================================
--- src/plugins/kdb/db2/libdb2/btree/bt_debug.c.orig
+++ src/plugins/kdb/db2/libdb2/btree/bt_debug.c
@@ -257,7 +257,8 @@ __bt_dpage(dbp, h)
 				    *(db_pgno_t *)bl->bytes,
 				    *(u_int32_t *)(bl->bytes + sizeof(db_pgno_t)));
 			else if (bl->ksize)
-				(void)fprintf(tracefp, "%s/", bl->bytes);
+				(void)fprintf(tracefp, "%.*s/",
+					      (int)bl->ksize, bl->bytes);
 			if (bl->flags & P_BIGDATA)
 				(void)fprintf(tracefp,
 				    "big data page %lu size %u",
Index: src/plugins/kdb/db2/libdb2/btree/bt_split.c
===================================================================
--- src/plugins/kdb/db2/libdb2/btree/bt_split.c.orig
+++ src/plugins/kdb/db2/libdb2/btree/bt_split.c
@@ -727,7 +727,7 @@ bt_psplit(t, h, l, r, pskip, ilen)
 	 * the right page.
 	 */
 	if (skip <= off) {
-		skip = 0;
+		skip = (indx_t)-1;
 		rval = l;
 	} else {
 		rval = r;
@@ -737,7 +737,7 @@ bt_psplit(t, h, l, r, pskip, ilen)
 	for (off = 0; nxt < top; ++off) {
 		if (skip == nxt) {
 			++off;
-			skip = 0;
+			skip = (indx_t)-1;
 		}
 		switch (h->flags & P_TYPE) {
 		case P_BINTERNAL:
Index: src/plugins/preauth/pkinit/configure.in
===================================================================
--- src/plugins/preauth/pkinit/configure.in.orig
+++ src/plugins/preauth/pkinit/configure.in
@@ -6,8 +6,6 @@ AC_CHECK_HEADERS(unistd.h)
 AC_TYPE_MODE_T
 AC_TYPE_OFF_T
 
-AC_CHECK_FUNCS()
-
 # XXX This is incorrect, but should cause -lcrypto to be included by default
 AC_CHECK_LIB(crypto, PKCS7_get_signer_info)
 
Index: src/appl/gssftp/ftp/ftp.M
===================================================================
--- src/appl/gssftp/ftp/ftp.M.orig
+++ src/appl/gssftp/ftp/ftp.M
@@ -537,7 +537,7 @@ $1.$2 and the remote file name "mydata.d
 "mydata", and $2 would have the value "data".  The
 .I outpattern
 determines the resulting mapped filename.  The sequences `$1', `$2',
-...., `$9' are replaced by any value resulting from the
+\&..., `$9' are replaced by any value resulting from the
 .I inpattern
 template.  The sequence `$0' is replace by the original filename.
 Additionally, the sequence `[\fIseq1\fP, \fIseq2\fP]' is replaced by
Index: src/appl/bsd/v4rcp.M
===================================================================
--- src/appl/bsd/v4rcp.M.orig
+++ src/appl/bsd/v4rcp.M
@@ -1,5 +1,5 @@
 .\" appl/bsd/v4rcp.M
-.TH RCP 1 \*h
+.TH V4RCP 1
 .SH NAME
 v4rcp \- back end for Kerberos V4 rcp
 .SH SYNOPSIS
Index: src/appl/telnet/telnet/telnet.1
===================================================================
--- src/appl/telnet/telnet/telnet.1.orig
+++ src/appl/telnet/telnet/telnet.1
@@ -625,7 +625,7 @@ Sends the
 .TP
 .B escape
 Sends the current
-.b telnet
+.B telnet
 escape character (initially ``^''.
 .TP
 .B ga
@@ -761,7 +761,7 @@ character.
 If
 .B telnet
 is in
-.b localchars
+.B localchars
 mode (see
 .B toggle localchars
 below),
@@ -1296,9 +1296,9 @@ is omitted, then an interactive subshell
 .TP
 \fB\&?\fP \fIcommand\fP
 Get help.  With no arguments,
-.b telnet
+.B telnet
 prints a help summary.  If a command is specified,
-.b telnet
+.B telnet
 will print the help information for just that command.
 .SH ENVIRONMENT
 .B Telnet
Index: src/clients/kpasswd/kpasswd.M
===================================================================
--- src/clients/kpasswd/kpasswd.M.orig
+++ src/clients/kpasswd/kpasswd.M
@@ -21,8 +21,7 @@
 .\" this software for any purpose.  It is provided "as is" without express
 .\" or implied warranty.
 .\" "
-.\.so man1/header.doc
-.TH KPASSWD 1 \*h
+.TH KPASSWD 1
 .SH NAME
 kpasswd \- change a user's Kerberos password
 .SH SYNOPSIS
Index: src/gen-manpages/k5login.M
===================================================================
--- src/gen-manpages/k5login.M.orig
+++ src/gen-manpages/k5login.M
@@ -1,6 +1,6 @@
 .TH .K5LOGIN 5
 .SH NAME
-.k5login \- Kerberos V5 acl file for host access.
+\&.k5login \- Kerberos V5 acl file for host access.
 .SH DESCRIPTION
 The
 .B .k5login
Index: src/kadmin/dbutil/kdb5_destroy.c
===================================================================
--- src/kadmin/dbutil/kdb5_destroy.c.orig
+++ src/kadmin/dbutil/kdb5_destroy.c
@@ -60,19 +60,16 @@ kdb5_destroy(argc, argv)
     retval1 = kadm5_init_krb5_context(&context);
     if( retval1 )
     {
-	com_err(argv[0], retval1, "while initializing krb5_context");
+	com_err(progname, retval1, "while initializing krb5_context");
 	exit(1);
     }
 
     if ((retval1 = krb5_set_default_realm(context,
 					  util_context->default_realm))) {
-	com_err(argv[0], retval1, "while setting default realm name");
+	com_err(progname, retval1, "while setting default realm name");
 	exit(1);
     }
     
-    if (strrchr(argv[0], '/'))
-	argv[0] = strrchr(argv[0], '/')+1;
-
     dbname = global_params.dbname;
 
     optind = 1;
@@ -102,7 +99,7 @@ kdb5_destroy(argc, argv)
 
     retval1 = krb5_db_destroy(context, db5util_db_args);
     if (retval1) {
-	com_err(argv[0], retval1, "deleting database '%s'",dbname);
+	com_err(progname, retval1, "deleting database '%s'",dbname);
 	exit_status++; return;
     }
 
Index: src/kadmin/dbutil/dump.c
===================================================================
--- src/kadmin/dbutil/dump.c.orig
+++ src/kadmin/dbutil/dump.c
@@ -1016,7 +1016,6 @@ dump_db(argc, argv)
 {
     FILE		*f;
     struct dump_args	arglist;
-    char		*programname;
     char		*ofile;
     krb5_error_code	kret, retval;
     dump_version	*dump;
@@ -1027,9 +1026,6 @@ dump_db(argc, argv)
     /*
      * Parse the arguments.
      */
-    programname = argv[0];
-    if (strrchr(programname, (int) '/'))
-	programname = strrchr(argv[0], (int) '/') + 1;
     ofile = (char *) NULL;
     dump = &r1_3_version;
     arglist.verbose = 0;
@@ -1081,7 +1077,7 @@ dump_db(argc, argv)
      * to be opened if we try a dump that uses it.
      */
     if (!dbactive) {
-	com_err(argv[0], 0, Err_no_database);
+	com_err(progname, 0, Err_no_database);
 	exit_status++;
 	return;
     }
@@ -1099,7 +1095,7 @@ dump_db(argc, argv)
 						(char *) NULL, 0,
 						&master_keyblock);
 		    if (retval) {
-			    com_err(argv[0], retval,
+			    com_err(progname, retval,
 				    "while reading master key");
 			    exit(1);
 		    }
@@ -1107,7 +1103,7 @@ dump_db(argc, argv)
 						       master_princ,
 						       &master_keyblock);
 		    if (retval) {
-			    com_err(argv[0], retval,
+			    com_err(progname, retval,
 				    "while verifying master key");
 			    exit(1);
 		    }
@@ -1124,7 +1120,7 @@ dump_db(argc, argv)
 					     TRUE, 
 					     new_mkey_file, 0,
 					     &new_master_keyblock))) { 
-		    com_err(argv[0], retval, "while reading new master key");
+		    com_err(progname, retval, "while reading new master key");
 		    exit(1);
 	    }
     }
@@ -1150,7 +1146,7 @@ dump_db(argc, argv)
 	unlink(ofile);
 	if (!(f = fopen(ofile, "w"))) {
 	    fprintf(stderr, ofopen_error,
-		    programname, ofile, error_message(errno));
+		    progname, ofile, error_message(errno));
 	    exit_status++;
 	    return;
        }
@@ -1158,7 +1154,7 @@ dump_db(argc, argv)
 				   fileno(f),
 				   KRB5_LOCKMODE_EXCLUSIVE))) {
 	    fprintf(stderr, oflock_error,
-		    programname, ofile, error_message(kret));
+		    progname, ofile, error_message(kret));
 	    exit_status++;
 	}
 	else
@@ -1167,7 +1163,7 @@ dump_db(argc, argv)
 	f = stdout;
     }
     if (f && !(kret)) {
-	arglist.programname = programname;
+	arglist.programname = progname;
 	arglist.ofile = f;
 	arglist.kcontext = util_context;
 	fprintf(arglist.ofile, "%s", dump->header);
@@ -1179,13 +1175,13 @@ dump_db(argc, argv)
 				    dump->dump_princ,
 				    (krb5_pointer) &arglist))) { /* TBD: backwards and recursive not supported */
 	     fprintf(stderr, dumprec_err,
-		     programname, dump->name, error_message(kret));
+		     progname, dump->name, error_message(kret));
 	     exit_status++;
 	}
 	if (dump->dump_policy &&
 	    (kret = krb5_db_iter_policy( util_context, "*", dump->dump_policy,
 					 &arglist))) { 
-	     fprintf(stderr, dumprec_err, programname, dump->name,
+	     fprintf(stderr, dumprec_err, progname, dump->name,
 		     error_message(kret));
 	     exit_status++;
 	}
@@ -2126,7 +2122,6 @@ load_db(argc, argv)
     FILE		*f;
     extern char		*optarg;
     extern int		optind;
-    char		*programname;
     char		*dumpfile;
     char		*dbname;
     char		*dbname_tmp;
@@ -2140,9 +2135,6 @@ load_db(argc, argv)
     /*
      * Parse the arguments.
      */
-    programname = argv[0];
-    if (strrchr(programname, (int) '/'))
-	programname = strrchr(argv[0], (int) '/') + 1;
     dumpfile = (char *) NULL;
     dbname = global_params.dbname;
     load = NULL;
@@ -2180,7 +2172,7 @@ load_db(argc, argv)
 
     if (!(dbname_tmp = (char *) malloc(strlen(dbname)+
 				       strlen(dump_tmptrail)+1))) {
-	fprintf(stderr, no_name_mem_fmt, argv[0]);
+	fprintf(stderr, no_name_mem_fmt, progname);
 	exit_status++;
 	return;
     }
@@ -2191,7 +2183,7 @@ load_db(argc, argv)
      * Initialize the Kerberos context and error tables.
      */
     if ((kret = kadm5_init_krb5_context(&kcontext))) {
-	fprintf(stderr, ctx_err_fmt, programname);
+	fprintf(stderr, ctx_err_fmt, progname);
 	free(dbname_tmp);
 	exit_status++;
 	return;
@@ -2199,7 +2191,7 @@ load_db(argc, argv)
 
     if( (kret = krb5_set_default_realm(kcontext, util_context->default_realm)) )
     {
-	fprintf(stderr, "%s: Unable to set the default realm\n", programname);
+	fprintf(stderr, "%s: Unable to set the default realm\n", progname);
 	free(dbname_tmp);
 	exit_status++;
 	return;
@@ -2210,14 +2202,14 @@ load_db(argc, argv)
      */
     if (dumpfile) {
 	if ((f = fopen(dumpfile, "r")) == NULL) {
-	     fprintf(stderr, dfile_err_fmt, programname, dumpfile,
+	     fprintf(stderr, dfile_err_fmt, progname, dumpfile,
 		     error_message(errno)); 
 	     exit_status++;
 	     return;
 	}
 	if ((kret = krb5_lock_file(kcontext, fileno(f),
 				   KRB5_LOCKMODE_SHARED))) {
-	     fprintf(stderr, "%s: Cannot lock %s: %s\n", programname,
+	     fprintf(stderr, "%s: Cannot lock %s: %s\n", progname,
 		     dumpfile, error_message(errno));
 	     exit_status++;
 	     return;
@@ -2233,7 +2225,7 @@ load_db(argc, argv)
     if (load) {
 	 /* only check what we know; some headers only contain a prefix */
 	 if (strncmp(buf, load->header, strlen(load->header)) != 0) {
-	      fprintf(stderr, head_bad_fmt, programname, dumpfile);
+	      fprintf(stderr, head_bad_fmt, progname, dumpfile);
 	      exit_status++;
 	      if (dumpfile) fclose(f);
 	      return;
@@ -2252,7 +2244,7 @@ load_db(argc, argv)
 			  strlen(ov_version.header)) == 0)
 	      load = &ov_version;
 	 else {
-	      fprintf(stderr, head_bad_fmt, programname, dumpfile);
+	      fprintf(stderr, head_bad_fmt, progname, dumpfile);
 	      exit_status++;
 	      if (dumpfile) fclose(f);
 	      return;
@@ -2260,7 +2252,7 @@ load_db(argc, argv)
     }
     if (load->updateonly && !update) {
 	 fprintf(stderr, "%s: dump version %s can only be loaded with the "
-		 "-update flag\n", programname, load->name);
+		 "-update flag\n", progname, load->name);
 	 exit_status++;
 	 return;
     }
@@ -2277,7 +2269,7 @@ load_db(argc, argv)
 
 	 if ((kret = kadm5_get_config_params(kcontext, 1,
 					     &newparams, &newparams))) {
-	      com_err(argv[0], kret,
+	      com_err(progname, kret,
 		      "while retreiving new configuration parameters");
 	      exit_status++;
 	      return;
@@ -2301,11 +2293,11 @@ load_db(argc, argv)
 	     */
 
 	    if (emsg != NULL) {
-		fprintf(stderr, "%s: %s\n", programname, emsg);
+		fprintf(stderr, "%s: %s\n", progname, emsg);
 		krb5_free_error_message (kcontext, emsg);
 	    } else {
 		fprintf(stderr, dbcreaterr_fmt,
-			programname, dbname, error_message(kret));
+			progname, dbname, error_message(kret));
 	    }
 	    exit_status++;
 	    kadm5_free_config_params(kcontext, &newparams);
@@ -2326,11 +2318,11 @@ load_db(argc, argv)
 		 */
 
 		if (emsg != NULL) {
-		    fprintf(stderr, "%s: %s\n", programname, emsg);
+		    fprintf(stderr, "%s: %s\n", progname, emsg);
 		    krb5_free_error_message (kcontext, emsg);
 		} else {
 		    fprintf(stderr, dbinit_err_fmt,
-			    programname, error_message(kret));
+			    progname, error_message(kret));
 		}
 		exit_status++;
 		goto error;
@@ -2349,7 +2341,7 @@ load_db(argc, argv)
 	 */
 	if (kret != KRB5_PLUGIN_OP_NOTSUPP) {
 	    fprintf(stderr, "%s: %s while permanently locking database\n",
-		    programname, error_message(kret));
+		    progname, error_message(kret));
 	    exit_status++;
 	    goto error;
 	}
@@ -2357,10 +2349,10 @@ load_db(argc, argv)
     else
 	db_locked = 1;
     
-    if (restore_dump(programname, kcontext, (dumpfile) ? dumpfile : stdin_name,
+    if (restore_dump(progname, kcontext, (dumpfile) ? dumpfile : stdin_name,
 		     f, verbose, load)) {
 	 fprintf(stderr, restfail_fmt,
-		 programname, load->name);
+		 progname, load->name);
 	 exit_status++;
     }
 
@@ -2373,14 +2365,14 @@ load_db(argc, argv)
     if (db_locked && (kret = krb5_db_unlock(kcontext))) {
 	 /* change this error? */
 	 fprintf(stderr, dbunlockerr_fmt,
-		 programname, dbname, error_message(kret));
+		 progname, dbname, error_message(kret));
 	 exit_status++;
     }
 
 #if 0
     if ((kret = krb5_db_fini(kcontext))) {
 	 fprintf(stderr, close_err_fmt,
-		 programname, error_message(kret));
+		 progname, error_message(kret));
 	 exit_status++;
     }
 #endif
@@ -2395,7 +2387,7 @@ load_db(argc, argv)
 	 */
 	if (kret != 0 && kret != KRB5_PLUGIN_OP_NOTSUPP) {
 	    fprintf(stderr, "%s: cannot make newly loaded database live (%s)\n",
-		    programname, error_message(kret));
+		    progname, error_message(kret));
 	    exit_status++;
 	}
     }
@@ -2416,7 +2408,7 @@ error:
 	       */
 	      if (kret != 0 && kret != KRB5_PLUGIN_OP_NOTSUPP) {
 		   fprintf(stderr, dbdelerr_fmt,
-			   programname, dbname, error_message(kret));
+			   progname, dbname, error_message(kret));
 		   exit_status++;
 	      }
 	 }
Index: src/kadmin/dbutil/kdb5_create.c
===================================================================
--- src/kadmin/dbutil/kdb5_create.c.orig
+++ src/kadmin/dbutil/kdb5_create.c
@@ -162,9 +162,6 @@ void kdb5_create(argc, argv)
     int do_stash = 0;
     krb5_data pwd, seed;
 	   
-    if (strrchr(argv[0], '/'))
-	argv[0] = strrchr(argv[0], '/')+1;
-
     while ((optchar = getopt(argc, argv, "s")) != -1) {
 	switch(optchar) {
 	case 's':
@@ -193,7 +190,7 @@ void kdb5_create(argc, argv)
     printf ("Loading random data\n");
     retval = krb5_c_random_os_entropy (util_context, 1, NULL);
     if (retval) {
-      com_err (argv[0], retval, "Loading random data");
+      com_err (progname, retval, "Loading random data");
       exit_status++; return;
     }
     
@@ -203,7 +200,7 @@ void kdb5_create(argc, argv)
 					  global_params.mkey_name,
 					  global_params.realm,  
 					  &mkey_fullname, &master_princ))) {
-	com_err(argv[0], retval, "while setting up master key name");
+	com_err(progname, retval, "while setting up master key name");
 	exit_status++; return;
     }
 
@@ -229,7 +226,7 @@ master key name '%s'\n",
 	retval = krb5_read_password(util_context, KRB5_KDC_MKEY_1, KRB5_KDC_MKEY_2,
 				    pw_str, &pw_size);
 	if (retval) {
-	    com_err(argv[0], retval, "while reading master key from keyboard");
+	    com_err(progname, retval, "while reading master key from keyboard");
 	    exit_status++; return;
 	}
 	mkey_password = pw_str;
@@ -239,14 +236,14 @@ master key name '%s'\n",
     pwd.length = strlen(mkey_password);
     retval = krb5_principal2salt(util_context, master_princ, &master_salt);
     if (retval) {
-	com_err(argv[0], retval, "while calculating master key salt");
+	com_err(progname, retval, "while calculating master key salt");
 	exit_status++; return;
     }
 
     retval = krb5_c_string_to_key(util_context, master_keyblock.enctype, 
 				  &pwd, &master_salt, &master_keyblock);
     if (retval) {
-	com_err(argv[0], retval, "while transforming master key from password");
+	com_err(progname, retval, "while transforming master key from password");
 	exit_status++; return;
     }
 
@@ -256,28 +253,28 @@ master key name '%s'\n",
     seed.data = master_keyblock.contents;
 
     if ((retval = krb5_c_random_seed(util_context, &seed))) {
-	com_err(argv[0], retval, "while initializing random key generator");
+	com_err(progname, retval, "while initializing random key generator");
 	exit_status++; return;
     }
     if ((retval = krb5_db_create(util_context,
 				 db5util_db_args))) {
-	com_err(argv[0], retval, "while creating database '%s'",
+	com_err(progname, retval, "while creating database '%s'",
 		global_params.dbname);
 	exit_status++; return;
     }
 /*     if ((retval = krb5_db_fini(util_context))) { */
-/*         com_err(argv[0], retval, "while closing current database"); */
+/*         com_err(progname, retval, "while closing current database"); */
 /*         exit_status++; return; */
 /*     } */
 /*     if ((retval = krb5_db_open(util_context, db5util_db_args, KRB5_KDB_OPEN_RW))) { */
-/* 	com_err(argv[0], retval, "while initializing the database '%s'", */
+/* 	com_err(progname, retval, "while initializing the database '%s'", */
 /* 		global_params.dbname); */
 /* 	exit_status++; return; */
 /*     } */
     if ((retval = add_principal(util_context, master_princ, MASTER_KEY, &rblock)) ||
 	(retval = add_principal(util_context, &tgt_princ, TGT_KEY, &rblock))) {
 	(void) krb5_db_fini(util_context);
-	com_err(argv[0], retval, "while adding entries to the database");
+	com_err(progname, retval, "while adding entries to the database");
 	exit_status++; return;
     }
     /*
@@ -291,7 +288,7 @@ master key name '%s'\n",
 				      &master_keyblock,
 				      mkey_password);
     if (retval) {
-	com_err(argv[0], errno, "while storing key");
+	com_err(progname, errno, "while storing key");
 	printf("Warning: couldn't stash master key.\n");
     }
     /* clean up */
Index: src/kadmin/dbutil/kdb5_util.c
===================================================================
--- src/kadmin/dbutil/kdb5_util.c.orig
+++ src/kadmin/dbutil/kdb5_util.c
@@ -186,16 +186,18 @@ int main(argc, argv)
 
     set_com_err_hook(extended_com_err_fn);
 
+    /*
+     * Ensure that "progname" is set before calling com_err.
+     */
+    progname = (strrchr(argv[0], '/') ?
+	    strrchr(argv[0], '/') + 1 : argv[0]);
+
     retval = kadm5_init_krb5_context(&util_context);
     if (retval) {
 	    com_err (progname, retval, "while initializing Kerberos code");
 	    exit(1);
     }
 
-/*     initialize_adb_error_table(); */
-
-    progname = (strrchr(argv[0], '/') ? strrchr(argv[0], '/')+1 : argv[0]);
-
     cmd_argv = (char **) malloc(sizeof(char *)*argc);
     if (cmd_argv == NULL) {
 	 com_err(progname, ENOMEM, "while creating sub-command arguments");
@@ -245,7 +247,7 @@ int main(argc, argv)
 	    }
        } else if (strcmp(*argv, "-k") == 0 && ARG_VAL) {
 	    if (krb5_string_to_enctype(koptarg, &global_params.enctype))
-		 com_err(argv[0], 0, "%s is an invalid enctype", koptarg);
+		 com_err(progname, 0, "%s is an invalid enctype", koptarg);
 	    else
 		 global_params.mask |= KADM5_CONFIG_ENCTYPE;
        } else if (strcmp(*argv, "-M") == 0 && ARG_VAL) {
@@ -287,7 +289,7 @@ int main(argc, argv)
     retval = kadm5_get_config_params(util_context, 1,
 				     &global_params, &global_params);
     if (retval) {
-	 com_err(argv[0], retval, "while retreiving configuration parameters");
+	 com_err(progname, retval, "while retreiving configuration parameters");
 	 exit(1);
     }
 
@@ -300,7 +302,7 @@ int main(argc, argv)
     master_keyblock.enctype = global_params.enctype;
     if ((master_keyblock.enctype != ENCTYPE_UNKNOWN) &&
 	(!krb5_c_valid_enctype(master_keyblock.enctype))) {
-	com_err(argv[0], KRB5_PROG_KEYTYPE_NOSUPP,
+	com_err(progname, KRB5_PROG_KEYTYPE_NOSUPP,
 		"while setting up enctype %d", master_keyblock.enctype);
     }
 
@@ -334,13 +336,13 @@ void set_dbname(argc, argv)
 
     if (argc < 3) {
 	com_err(argv[0], 0, "Too few arguments");
-	com_err(argv[0], 0, "Usage: %s dbpathname realmname", argv[0]);
+	com_err(progname, 0, "Usage: %s dbpathname realmname", argv[0]);
 	exit_status++;
 	return;
     }
     if (dbactive) {
 	if ((retval = krb5_db_fini(util_context)) && retval!= KRB5_KDB_DBNOTINITED) {
-	    com_err(argv[0], retval, "while closing previous database");
+	    com_err(progname, retval, "while closing previous database");
 	    exit_status++;
 	    return;
 	}
@@ -353,7 +355,7 @@ void set_dbname(argc, argv)
 	dbactive = FALSE;
     }
 
-    (void) set_dbname_help(argv[0], argv[1]);
+    (void) set_dbname_help(progname, argv[1]);
     return;
 }
 #endif
@@ -425,6 +427,7 @@ static int open_db_and_mkey()
 	retval = krb5_principal2salt(util_context, master_princ, &scratch);
 	if (retval) {
 	    com_err(progname, retval, "while calculated master key salt");
+	    exit_status++;
 	    return(1);
 	}
 
@@ -442,6 +445,7 @@ static int open_db_and_mkey()
 	if (retval) {
 	    com_err(progname, retval,
 		    "while transforming master key from password");
+	    exit_status++;
 	    return(1);
 	}
 	free(scratch.data);
@@ -519,7 +523,7 @@ add_random_key(argc, argv)
     krb5_int32 num_keysalts = 0;
 
     int free_keysalts;
-    char *me = argv[0];
+    char *me = progname;
     char *ks_str = NULL;
     char *pr_str;
 
Index: src/kadmin/dbutil/kdb5_stash.c
===================================================================
--- src/kadmin/dbutil/kdb5_stash.c.orig
+++ src/kadmin/dbutil/kdb5_stash.c
@@ -82,19 +82,16 @@ kdb5_stash(argc, argv)
     char *keyfile = 0;
     krb5_context context;
 
-    if (strrchr(argv[0], '/'))
-	argv[0] = strrchr(argv[0], '/')+1;
-
     retval = kadm5_init_krb5_context(&context);
     if( retval )
     {
-	com_err(argv[0], retval, "while initializing krb5_context");
+	com_err(progname, retval, "while initializing krb5_context");
 	exit(1);
     }
 
     if ((retval = krb5_set_default_realm(context,
 					  util_context->default_realm))) {
-	com_err(argv[0], retval, "while setting default realm name");
+	com_err(progname, retval, "while setting default realm name");
 	exit(1);
     }
 
@@ -119,10 +116,10 @@ kdb5_stash(argc, argv)
     if (!krb5_c_valid_enctype(master_keyblock.enctype)) {
 	char tmp[32];
 	if (krb5_enctype_to_string(master_keyblock.enctype, tmp, sizeof(tmp)))
-	    com_err(argv[0], KRB5_PROG_KEYTYPE_NOSUPP,
+	    com_err(progname, KRB5_PROG_KEYTYPE_NOSUPP,
 		    "while setting up enctype %d", master_keyblock.enctype);
 	else
-	    com_err(argv[0], KRB5_PROG_KEYTYPE_NOSUPP, tmp);
+	    com_err(progname, KRB5_PROG_KEYTYPE_NOSUPP, tmp);
 	exit_status++; return; 
     }
 
@@ -130,14 +127,14 @@ kdb5_stash(argc, argv)
     retval = krb5_db_setup_mkey_name(context, mkey_name, realm, 
 				     &mkey_fullname, &master_princ);
     if (retval) {
-	com_err(argv[0], retval, "while setting up master key name");
+	com_err(progname, retval, "while setting up master key name");
 	exit_status++; return; 
     }
 
     retval = krb5_db_open(context, db5util_db_args, 
 			  KRB5_KDB_OPEN_RW | KRB5_KDB_SRV_TYPE_OTHER);
     if (retval) {
-	com_err(argv[0], retval, "while initializing the database '%s'",
+	com_err(progname, retval, "while initializing the database '%s'",
 		dbname);
 	exit_status++; return; 
     }
@@ -148,7 +145,7 @@ kdb5_stash(argc, argv)
 				TRUE, FALSE, (char *) NULL,
 				0, &master_keyblock);
     if (retval) {
-	com_err(argv[0], retval, "while reading master key");
+	com_err(progname, retval, "while reading master key");
 	(void) krb5_db_fini(context);
 	exit_status++; return; 
     }
@@ -156,7 +153,7 @@ kdb5_stash(argc, argv)
     retval = krb5_db_verify_master_key(context, master_princ, 
 				       &master_keyblock);
     if (retval) {
-	com_err(argv[0], retval, "while verifying master key");
+	com_err(progname, retval, "while verifying master key");
 	(void) krb5_db_fini(context);
 	exit_status++; return; 
     }	
@@ -164,7 +161,7 @@ kdb5_stash(argc, argv)
     retval = krb5_db_store_master_key(context, keyfile, master_princ, 
 				      &master_keyblock, NULL);
     if (retval) {
-	com_err(argv[0], errno, "while storing key");
+	com_err(progname, errno, "while storing key");
 	memset((char *)master_keyblock.contents, 0, master_keyblock.length);
 	(void) krb5_db_fini(context);
 	exit_status++; return; 
@@ -173,7 +170,7 @@ kdb5_stash(argc, argv)
 
     retval = krb5_db_fini(context);
     if (retval) {
-	com_err(argv[0], retval, "closing database '%s'", dbname);
+	com_err(progname, retval, "closing database '%s'", dbname);
 	exit_status++; return; 
     }
 
Index: src/kadmin/cli/kadmin.M
===================================================================
--- src/kadmin/cli/kadmin.M.orig
+++ src/kadmin/cli/kadmin.M
@@ -206,12 +206,12 @@ Specifying "ago" in a duration may resul
 creates the principal
 .IR newprinc ,
 prompting twice for a password.  If no policy is specified with the
--policy option, and the policy named "default" exists, then that
+\-policy option, and the policy named "default" exists, then that
 policy is assigned to the principal; note that the assignment of the
 policy "default" only occurs automatically when a principal is first
 created, so the policy "default" must already exist for the assignment
 to occur.  This assignment of "default" can be suppressed with the
--clearpolicy option.  This command requires the 
+\-clearpolicy option.  This command requires the 
 .I add
 privilege.  This command has the aliases
 .B addprinc
@@ -411,7 +411,7 @@ Re-enter password for principal tlyu/adm
 Principal "tlyu/admin@BLEEP.COM" created.
 kadmin:
 
-kadmin: addprinc -x dn=cn=mwm_user,o=org mwm_user
+kadmin: addprinc \-x dn=cn=mwm_user,o=org mwm_user
 WARNING: no policy specified for "mwm_user@BLEEP.COM";
 defaulting to no policy.
 Enter password for principal mwm_user@BLEEP.COM: 
@@ -639,7 +639,7 @@ sets the number of past keys kept for a
 .nf
 .TP
 EXAMPLES:
-kadmin: add_policy -maxlife "2 days" -minlength 5 guests
+kadmin: add_policy \-maxlife "2 days" \-minlength 5 guests
 kadmin:
 .TP
 ERRORS:
Index: src/lib/crypto/enc_provider/aes.c
===================================================================
--- src/lib/crypto/enc_provider/aes.c.orig
+++ src/lib/crypto/enc_provider/aes.c
@@ -1,3 +1,29 @@
+/*
+ * lib/crypto/enc_provider/aes.h
+ *
+ * Copyright (C) 2003, 2007 by the Massachusetts Institute of Technology.
+ * All rights reserved.
+ *
+ * Export of this software from the United States of America may
+ *   require a specific license from the United States Government.
+ *   It is the responsibility of any person or organization contemplating
+ *   export to obtain such a license before exporting.
+ *
+ * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
+ * distribute this software and its documentation for any purpose and
+ * without fee is hereby granted, provided that the above copyright
+ * notice appear in all copies and that both that copyright notice and
+ * this permission notice appear in supporting documentation, and that
+ * the name of M.I.T. not be used in advertising or publicity pertaining
+ * to distribution of the software without specific, written prior
+ * permission.  Furthermore if you modify this software you must label
+ * your software as modified software and not distribute it in such a
+ * fashion that it might be confused with the original M.I.T. software.
+ * M.I.T. makes no representations about the suitability of
+ * this software for any purpose.  It is provided "as is" without express
+ * or implied warranty.
+ */
+
 #include "k5-int.h"
 #include "enc_provider.h"
 #include "aes.h"
Index: src/lib/rpc/auth_gssapi.c
===================================================================
--- src/lib/rpc/auth_gssapi.c.orig
+++ src/lib/rpc/auth_gssapi.c
@@ -164,6 +164,11 @@ AUTH *auth_gssapi_create(
      auth = (AUTH *) malloc(sizeof(*auth));
      pdata = (struct auth_gssapi_data *) malloc(sizeof(*pdata));
      if (auth == NULL || pdata == NULL) {
+	  /* They needn't both have failed; clean up.  */
+	  free(auth);
+	  free(pdata);
+	  auth = NULL;
+	  pdata = NULL;
 	  rpc_createerr.cf_stat = RPC_SYSTEMERROR;
 	  rpc_createerr.cf_error.re_errno = ENOMEM;
 	  goto cleanup;
@@ -436,12 +441,14 @@ next_token:
      
 cleanup:
      PRINTF(("gssapi_create: bailing\n\n"));
-     
-     if (AUTH_PRIVATE(auth))
-	  auth_gssapi_destroy(auth);
-     else if (auth)
-	  free(auth);
-     auth = NULL;
+
+     if (auth) {
+	 if (AUTH_PRIVATE(auth))
+	     auth_gssapi_destroy(auth);
+	 else
+	     free(auth);
+	 auth = NULL;
+     }
      
      /* don't assume the caller will want to change clnt->cl_auth */
      clnt->cl_auth = save_auth;
Index: src/lib/gssapi/krb5/lucid_context.c
===================================================================
--- src/lib/gssapi/krb5/lucid_context.c.orig
+++ src/lib/gssapi/krb5/lucid_context.c
@@ -231,7 +231,7 @@ make_external_lucid_ctx_v1(
 	    				&lctx->cfx_kd.ctx_key)))
 	    goto error_out;
 	if (gctx->have_acceptor_subkey) {
-	    if ((retval = copy_keyblock_to_lucid_key(gctx->enc,
+	    if ((retval = copy_keyblock_to_lucid_key(gctx->acceptor_subkey,
 	    				&lctx->cfx_kd.acceptor_subkey)))
 		goto error_out;
 	    lctx->cfx_kd.have_acceptor_subkey = 1;
Index: src/lib/kadm5/str_conv.c
===================================================================
--- src/lib/kadm5/str_conv.c.orig
+++ src/lib/kadm5/str_conv.c
@@ -310,7 +310,7 @@ krb5_string_to_keysalts(string, tuplesep
 	septmp = ksseplist;
 	for (sp = strchr(kp, (int) *septmp);
 	     *(++septmp) && !sp;
-	     ep = strchr(kp, (int) *septmp));
+	     sp = strchr(kp, (int) *septmp));
 
 	if (sp) {
 	    /* Separate enctype from salttype */
Index: src/lib/krb5/keytab/kt_file.c
===================================================================
--- src/lib/krb5/keytab/kt_file.c.orig
+++ src/lib/krb5/keytab/kt_file.c
@@ -53,10 +53,30 @@ typedef struct _krb5_ktfile_data {
     FILE *openf;		/* open file, if any. */
     char iobuf[BUFSIZ];		/* so we can zap it later */
     int	version;		/* Version number of keytab */
+    unsigned int iter_count;	/* Number of active iterators */
+    long start_offset;		/* Starting offset after version */
     k5_mutex_t lock;		/* Protect openf, version */
 } krb5_ktfile_data;
 
 /*
+ * Some limitations:
+ *
+ * If the file OPENF is left open between calls, we have an iterator
+ * active, and OPENF is opened in read-only mode.  So, no changes
+ * can be made via that handle.
+ *
+ * An advisory file lock is used while the file is open.  Thus,
+ * multiple handles on the same underlying file cannot be used without
+ * disrupting the locking in effect.
+ *
+ * The start_offset field is only valid if the file is open.  It will
+ * almost certainly always be the same constant.  It's used so that
+ * if an iterator is active, and we start another one, we don't have
+ * to seek back to the start and re-read the version number to set
+ * the position for the iterator.
+ */
+
+/*
  * Macros
  */
 #define KTPRIVATE(id) ((krb5_ktfile_data *)(id)->data)
@@ -64,6 +84,8 @@ typedef struct _krb5_ktfile_data {
 #define KTFILEP(id) (((krb5_ktfile_data *)(id)->data)->openf)
 #define KTFILEBUFP(id) (((krb5_ktfile_data *)(id)->data)->iobuf)
 #define KTVERSION(id) (((krb5_ktfile_data *)(id)->data)->version)
+#define KTITERS(id) (((krb5_ktfile_data *)(id)->data)->iter_count)
+#define KTSTARTOFF(id) (((krb5_ktfile_data *)(id)->data)->start_offset)
 #define KTLOCK(id) k5_mutex_lock(&((krb5_ktfile_data *)(id)->data)->lock)
 #define KTUNLOCK(id) k5_mutex_unlock(&((krb5_ktfile_data *)(id)->data)->lock)
 #define KTCHECKLOCK(id) k5_mutex_assert_locked(&((krb5_ktfile_data *)(id)->data)->lock)
@@ -208,6 +230,7 @@ krb5_ktfile_resolve(krb5_context context
     (void) strcpy(data->name, name);
     data->openf = 0;
     data->version = 0;
+    data->iter_count = 0;
 
     (*id)->data = (krb5_pointer)data;
     (*id)->magic = KV5M_KEYTAB;
@@ -255,15 +278,27 @@ krb5_ktfile_get_entry(krb5_context conte
     int found_wrong_kvno = 0;
     krb5_boolean similar;
     int kvno_offset = 0;
+    int was_open;
 
     kerror = KTLOCK(id);
     if (kerror)
 	return kerror;
 
-    /* Open the keyfile for reading */
-    if ((kerror = krb5_ktfileint_openr(context, id))) {
-	KTUNLOCK(id);
-	return(kerror);
+    if (KTFILEP(id) != NULL) {
+	was_open = 1;
+
+	if (fseek(KTFILEP(id), KTSTARTOFF(id), SEEK_SET) == -1) {
+	    KTUNLOCK(id);
+	    return errno;
+	}
+    } else {
+	was_open = 0;
+
+	/* Open the keyfile for reading */
+	if ((kerror = krb5_ktfileint_openr(context, id))) {
+	    KTUNLOCK(id);
+	    return(kerror);
+	}
     }
     
     /* 
@@ -370,12 +405,13 @@ krb5_ktfile_get_entry(krb5_context conte
 	      kerror = KRB5_KT_NOTFOUND;
     }
     if (kerror) {
-	(void) krb5_ktfileint_close(context, id);
+	if (was_open == 0)
+	    (void) krb5_ktfileint_close(context, id);
 	KTUNLOCK(id);
 	krb5_kt_free_entry(context, &cur_entry);
 	return kerror;
     }
-    if ((kerror = krb5_ktfileint_close(context, id)) != 0) {
+    if (was_open == 0 && (kerror = krb5_ktfileint_close(context, id)) != 0) {
 	KTUNLOCK(id);
 	krb5_kt_free_entry(context, &cur_entry);
 	return kerror;
@@ -430,18 +466,30 @@ krb5_ktfile_start_seq_get(krb5_context c
     if (retval)
 	return retval;
 
-    if ((retval = krb5_ktfileint_openr(context, id))) {
-	KTUNLOCK(id);
-	return retval;
+    if (KTITERS(id) == 0) {
+	if ((retval = krb5_ktfileint_openr(context, id))) {
+	    KTUNLOCK(id);
+	    return retval;
+	}
     }
 
     if (!(fileoff = (long *)malloc(sizeof(*fileoff)))) {
-	krb5_ktfileint_close(context, id);
+	if (KTITERS(id) == 0)
+	    krb5_ktfileint_close(context, id);
 	KTUNLOCK(id);
 	return ENOMEM;
     }
-    *fileoff = ftell(KTFILEP(id));
+    *fileoff = KTSTARTOFF(id);
     *cursorp = (krb5_kt_cursor)fileoff;
+    KTITERS(id)++;
+    if (KTITERS(id) == 0) {
+	/* Wrapped?!  */
+	KTITERS(id)--;
+	KTUNLOCK(id);
+	krb5_set_error_message(context, KRB5_KT_IOERR,
+			       "Too many keytab iterators active");
+	return KRB5_KT_IOERR;	/* XXX */
+    }
     KTUNLOCK(id);
 
     return 0;
@@ -490,7 +538,11 @@ krb5_ktfile_end_get(krb5_context context
 
     krb5_xfree(*cursor);
     KTLOCK(id);
-    kerror = krb5_ktfileint_close(context, id);
+    KTITERS(id)--;
+    if (KTFILEP(id) != NULL && KTITERS(id) == 0)
+	kerror = krb5_ktfileint_close(context, id);
+    else
+	kerror = 0;
     KTUNLOCK(id);
     return kerror;
 }
@@ -811,6 +863,7 @@ krb5_ktfile_wresolve(krb5_context contex
     (void) strcpy(data->name, name);
     data->openf = 0;
     data->version = 0;
+    data->iter_count = 0;
 
     (*id)->data = (krb5_pointer)data;
     (*id)->magic = KV5M_KEYTAB;
@@ -830,6 +883,13 @@ krb5_ktfile_add(krb5_context context, kr
     retval = KTLOCK(id);
     if (retval)
 	return retval;
+    if (KTFILEP(id)) {
+	/* Iterator(s) active -- no changes.  */
+	KTUNLOCK(id);
+	krb5_set_error_message(context, KRB5_KT_IOERR,
+			       "Cannot change keytab with keytab iterators active");
+	return KRB5_KT_IOERR;	/* XXX */
+    }
     if ((retval = krb5_ktfileint_openw(context, id))) {
 	KTUNLOCK(id);
 	return retval;
@@ -858,6 +918,13 @@ krb5_ktfile_remove(krb5_context context,
     kerror = KTLOCK(id);
     if (kerror)
 	return kerror;
+    if (KTFILEP(id)) {
+	/* Iterator(s) active -- no changes.  */
+	KTUNLOCK(id);
+	krb5_set_error_message(context, KRB5_KT_IOERR,
+			       "Cannot change keytab with keytab iterators active");
+	return KRB5_KT_IOERR;	/* XXX */
+    }
 
     if ((kerror = krb5_ktfileint_openw(context, id))) {
 	KTUNLOCK(id);
@@ -1114,6 +1181,7 @@ krb5_ktfileint_open(krb5_context context
 	    return KRB5_KEYTAB_BADVNO;
 	}
     }
+    KTSTARTOFF(id) = ftell(KTFILEP(id));
     return 0;
 }
 
@@ -1424,7 +1492,7 @@ krb5_ktfileint_write_entry(krb5_context
     krb5_timestamp timestamp;
     krb5_int32	princ_type;
     krb5_int32  size_needed;
-    krb5_int32  commit_point;
+    krb5_int32  commit_point = -1;
     int		i;
 
     KTCHECKLOCK(id);
Index: src/lib/krb5/os/toffset.c
===================================================================
--- src/lib/krb5/os/toffset.c.orig
+++ src/lib/krb5/os/toffset.c
@@ -34,6 +34,9 @@
  * routines will return the correct time as corrected by difference
  * between the system time and the "real time" as passed to this
  * routine
+ *
+ * If the real time microseconds are given as -1 the caller doesn't
+ * know the microseconds value so the usec offset is always zero.
  */
 krb5_error_code KRB5_CALLCONV
 krb5_set_real_time(krb5_context context, krb5_timestamp seconds, krb5_int32 microseconds)
@@ -45,8 +48,10 @@ krb5_set_real_time(krb5_context context,
     retval = krb5_crypto_us_timeofday(&sec, &usec);
     if (retval)
 	    return retval;
+
     os_ctx->time_offset = seconds - sec;
-    os_ctx->usec_offset = microseconds - usec;
+    os_ctx->usec_offset = (microseconds > -1) ? microseconds - usec : 0;
+
     os_ctx->os_flags = ((os_ctx->os_flags & ~KRB5_OS_TOFFSET_TIME) |
 			KRB5_OS_TOFFSET_VALID);
     return 0;
Index: src/lib/krb5/os/locate_kdc.c
===================================================================
--- src/lib/krb5/os/locate_kdc.c.orig
+++ src/lib/krb5/os/locate_kdc.c
@@ -611,6 +611,7 @@ module_locate_server (krb5_context ctx,
     krb5_error_code code;
     struct krb5plugin_service_locate_ftable *vtbl = NULL;
     void **ptrs;
+    char *realmz;		/* NUL-terminated realm */
     int i;
     struct module_callback_data cbdata = { 0, };
 
@@ -632,6 +633,17 @@ module_locate_server (krb5_context ctx,
 	return KRB5_PLUGIN_NO_HANDLE;
     }
 
+    if (realm->length >= UINT_MAX) {
+	krb5int_free_plugin_dir_data(ptrs);
+	return ENOMEM;
+    }
+    realmz = malloc(realm->length + 1);
+    if (realmz == NULL) {
+	krb5int_free_plugin_dir_data(ptrs);
+	return ENOMEM;
+    }
+    memcpy(realmz, realm->data, realm->length);
+    realmz[realm->length] = '\0';
     for (i = 0; ptrs[i]; i++) {
 	void *blob;
 
@@ -644,7 +656,7 @@ module_locate_server (krb5_context ctx,
 	if (code)
 	    continue;
 
-	code = vtbl->lookup(blob, svc, realm->data, socktype, family,
+	code = vtbl->lookup(blob, svc, realmz, socktype, family,
 			    module_callback, &cbdata);
 	vtbl->fini(blob);
 	if (code == KRB5_PLUGIN_NO_HANDLE) {
@@ -657,6 +669,7 @@ module_locate_server (krb5_context ctx,
 	    /* Module encountered an actual error.  */
 	    Tprintf("plugin lookup routine returned error %d: %s\n",
 		    code, error_message(code));
+	    free(realmz);
 	    krb5int_free_plugin_dir_data (ptrs);
 	    return code;
 	}
@@ -664,6 +677,7 @@ module_locate_server (krb5_context ctx,
     }
     if (ptrs[i] == NULL) {
 	Tprintf("ran off end of plugin list\n");
+	free(realmz);
 	krb5int_free_plugin_dir_data (ptrs);
 	return KRB5_PLUGIN_NO_HANDLE;
     }
@@ -672,6 +686,7 @@ module_locate_server (krb5_context ctx,
     /* Got something back, yippee.  */
     Tprintf("now have %d addrs in list %p\n", addrlist->naddrs, addrlist);
     print_addrlist(addrlist);
+    free(realmz);
     krb5int_free_plugin_dir_data (ptrs);
     return 0;
 }
Index: src/lib/krb5/rcache/rc_io.c
===================================================================
--- src/lib/krb5/rcache/rc_io.c.orig
+++ src/lib/krb5/rcache/rc_io.c
@@ -83,6 +83,7 @@ krb5_rc_io_creat(krb5_context context, k
 	(void) strcpy(d->fn, dir);
 	(void) strcat(d->fn, PATH_SEPARATOR);
 	(void) strcat(d->fn, *fn);
+	unlink(d->fn);
 	d->fd = THREEPARAMOPEN(d->fn, O_WRONLY | O_CREAT | O_TRUNC | O_EXCL |
 			       O_BINARY, 0600);
     }
@@ -425,7 +426,7 @@ krb5_rc_io_read(krb5_context context, kr
 				   strerror(errno));
 	    return KRB5_RC_IO_UNKNOWN;
 	}
-    if (count == 0)
+    if (count != num)
 	return KRB5_RC_IO_EOF;
     return 0;
 }
Index: src/lib/krb5/ccache/cc_memory.c
===================================================================
--- src/lib/krb5/ccache/cc_memory.c.orig
+++ src/lib/krb5/ccache/cc_memory.c
@@ -135,10 +135,18 @@ krb5_error_code KRB5_CALLCONV
 krb5_mcc_initialize(krb5_context context, krb5_ccache id, krb5_principal princ)
 {
     krb5_error_code ret; 
+    krb5_mcc_data *d;
+
+    d = (krb5_mcc_data *)id->data;
+    ret = k5_mutex_lock(&d->lock);
+    if (ret)
+        return ret;
 
     krb5_mcc_free(context, id);
     ret = krb5_copy_principal(context, princ,
 			      &((krb5_mcc_data *)id->data)->prin);
+
+    k5_mutex_unlock(&d->lock);
     if (ret == KRB5_OK)
         krb5_change_cache();
     return ret;
@@ -205,8 +213,13 @@ krb5_mcc_destroy(krb5_context context, k
     }
     k5_mutex_unlock(&krb5int_mcc_mutex);
 
+    err = k5_mutex_lock(&d->lock);
+    if (err)
+        return err;
+
     krb5_mcc_free(context, id);
     krb5_xfree(d->name);
+    k5_mutex_unlock(&d->lock);
     k5_mutex_destroy(&d->lock);
     krb5_xfree(d); 
     krb5_xfree(id);
@@ -244,12 +257,6 @@ krb5_mcc_resolve (krb5_context context,
     krb5_error_code err;
     krb5_mcc_data *d;
 
-    lid = (krb5_ccache) malloc(sizeof(struct _krb5_ccache));
-    if (lid == NULL)
-	return KRB5_CC_NOMEM;
-
-    lid->ops = &krb5_mcc_ops;
-
     err = k5_mutex_lock(&krb5int_mcc_mutex);
     if (err)
 	return err;
@@ -262,11 +269,16 @@ krb5_mcc_resolve (krb5_context context,
 	err = new_mcc_data(residual, &d);
 	if (err) {
 	    k5_mutex_unlock(&krb5int_mcc_mutex);
-	    krb5_xfree(lid);
 	    return err;
 	}
     }
     k5_mutex_unlock(&krb5int_mcc_mutex);
+
+    lid = (krb5_ccache) malloc(sizeof(struct _krb5_ccache));
+    if (lid == NULL)
+	return KRB5_CC_NOMEM;
+    
+    lid->ops = &krb5_mcc_ops;
     lid->data = d;
     *id = lid; 
     return KRB5_OK;
Index: src/lib/krb5/ccache/ccdefault.c
===================================================================
--- src/lib/krb5/ccache/ccdefault.c.orig
+++ src/lib/krb5/ccache/ccdefault.c
@@ -1,7 +1,7 @@
 /*
  * lib/krb5/ccache/ccdefault.c
  *
- * Copyright 1990 by the Massachusetts Institute of Technology.
+ * Copyright 1990, 2007, 2008 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -45,22 +45,30 @@ static HANDLE hLeashDLL = INVALID_HANDLE
 krb5_error_code KRB5_CALLCONV
 krb5_cc_default(krb5_context context, krb5_ccache *ccache)
 {
-	krb5_os_context	os_ctx;
+	const char *default_name;
 
 	if (!context || context->magic != KV5M_CONTEXT)
 		return KV5M_CONTEXT;
+
+	default_name = krb5_cc_default_name(context);
+	if (default_name == NULL) {
+	    /* Could be a bogus context, or an allocation failure, or
+	       other things.  Unfortunately the API doesn't allow us
+	       to find out any specifics.  */
+	    return KRB5_FCC_INTERNAL;
+	}
 	
-	os_ctx = context->os_context;
-	
-	return krb5_cc_resolve(context, krb5_cc_default_name(context), ccache);
+	return krb5_cc_resolve(context, default_name, ccache);
 }
 
-/* This is the internal function which opens the default ccache.  On platforms supporting
-   the login library's automatic popup dialog to get tickets, this function also updated the
-   library's internal view of the current principal associated with this cache. 
-   
-   All krb5 and GSS functions which need to open a cache to get a tgt to obtain service tickets
-   should call this function, not krb5_cc_default() */
+/* This is the internal function which opens the default ccache.  On
+   platforms supporting the login library's automatic popup dialog to
+   get tickets, this function also updated the library's internal view
+   of the current principal associated with this cache.
+
+   All krb5 and GSS functions which need to open a cache to get a tgt
+   to obtain service tickets should call this function, not
+   krb5_cc_default().  */
 
 krb5_error_code KRB5_CALLCONV
 krb5int_cc_default(krb5_context context, krb5_ccache *ccache)
@@ -82,7 +90,8 @@ krb5int_cc_default(krb5_context context,
             /* This function tries to get tickets and put them in the specified 
             cache, however, if the cache does not exist, it may choose to put 
             them elsewhere (ie: the system default) so we set that here */
-            if (strcmp (krb5_cc_default_name (context), outCacheName) != 0) {
+            char * ccdefname = krb5_cc_default_name (context);
+            if (!ccdefname || strcmp (ccdefname, outCacheName) != 0) {
                 krb5_cc_set_default_name (context, outCacheName);
             }
             KLDisposeString (outCacheName);
@@ -102,7 +111,8 @@ krb5int_cc_default(krb5_context context,
 	char ccname[256]="";
         pLeash_AcquireInitialTicketsIfNeeded(context, NULL, ccname, sizeof(ccname));
 	if (ccname[0]) {
-            if (strcmp (krb5_cc_default_name (context),ccname) != 0) {
+            char * ccdefname = krb5_cc_default_name (context);
+            if (!ccdefname || strcmp (ccdefname, ccname) != 0) {
                 krb5_cc_set_default_name (context, ccname);
             }
 	}
Index: src/lib/krb5/krb/get_in_tkt.c
===================================================================
--- src/lib/krb5/krb/get_in_tkt.c.orig
+++ src/lib/krb5/krb/get_in_tkt.c
@@ -290,7 +290,7 @@ verify_as_reply(krb5_context 		context,
 
     if (context->library_options & KRB5_LIBOPT_SYNC_KDCTIME) {
 	retval = krb5_set_real_time(context,
-				    as_reply->enc_part2->times.authtime, 0);
+				    as_reply->enc_part2->times.authtime, -1);
 	if (retval)
 	    return retval;
     } else {
Index: src/lib/krb5/krb/rd_safe.c
===================================================================
--- src/lib/krb5/krb/rd_safe.c.orig
+++ src/lib/krb5/krb/rd_safe.c
@@ -1,7 +1,7 @@
 /*
  * lib/krb5/krb/rd_safe.c
  *
- * Copyright 1990,1991 by the Massachusetts Institute of Technology.
+ * Copyright 1990,1991,2007,2008 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -114,11 +114,11 @@ krb5_rd_safe_basic(krb5_context context,
 
     message->checksum = &our_cksum;
 
-    if ((retval = encode_krb5_safe_with_body(message, &safe_body, &scratch)))
+    retval = encode_krb5_safe_with_body(message, &safe_body, &scratch);
+    message->checksum = his_cksum;
+    if (retval)
 	goto cleanup;
 
-    message->checksum = his_cksum;
-			 
     retval = krb5_c_verify_checksum(context, keyblock,
 				    KRB5_KEYUSAGE_KRB_SAFE_CKSUM,
 				    scratch, his_cksum, &valid);
Index: src/lib/krb5/krb/gc_via_tkt.c
===================================================================
--- src/lib/krb5/krb/gc_via_tkt.c.orig
+++ src/lib/krb5/krb/gc_via_tkt.c
@@ -1,7 +1,7 @@
 /*
  * lib/krb5/krb/gc_via_tgt.c
  *
- * Copyright 1990,1991 by the Massachusetts Institute of Technology.
+ * Copyright 1990,1991,2007,2008 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -100,6 +100,7 @@ cleanup_keyblock:
 
 cleanup:
     free (*ppcreds);
+    *ppcreds = NULL;
     return retval;
 }
  
@@ -249,7 +250,8 @@ krb5_get_cred_via_tkt (krb5_context cont
 	    switch (err_reply->error) {
 	    case KRB_ERR_GENERIC:
 		krb5_set_error_message(context, retval,
-				       "KDC returned error string: %s",
+				       "KDC returned error string: %.*s",
+				       err_reply->text.length,
 				       err_reply->text.data);
 		break;
 	    default:
Index: src/slave/kpropd.M
===================================================================
--- src/slave/kpropd.M.orig
+++ src/slave/kpropd.M
@@ -122,7 +122,7 @@ mode.
 .TP
 .B \-a
 allows the user to specify the path to the
-.KR kpropd.acl
+kpropd.acl
 file; by default the path used is KPROPD_ACL_FILE
 (normally @manlocalstatedir@/krb5kdc/kpropd.acl).
 .SH FILES
Index: src/util/depfix.pl
===================================================================
--- src/util/depfix.pl.orig
+++ src/util/depfix.pl
@@ -214,6 +214,7 @@ my $buf = '';
 while (<STDIN>) {
     # Strip newline.
     chop;
+    next if /^\s*#/;
     # Do directory-specific path substitutions on each filename read.
     $_ = &do_subs($_);
     if (m/\\$/) {
Index: src/util/profile/prof_init.c
===================================================================
--- src/util/profile/prof_init.c.orig
+++ src/util/profile/prof_init.c
@@ -34,8 +34,11 @@ profile_init(const_profile_filespec_t *f
 	memset(profile, 0, sizeof(struct _profile_t));
 	profile->magic = PROF_MAGIC_PROFILE;
 
-        /* if the filenames list is not specified return an empty profile */
-        if ( files ) {
+	/*
+	 * If the filenames list is not specified or empty, return an empty
+	 * profile.
+	 */
+	if ( files && !PROFILE_LAST_FILESPEC(*files) ) {
 	    for (fs = files; !PROFILE_LAST_FILESPEC(*fs); fs++) {
 		retval = profile_open_file(*fs, &new_file);
 		/* if this file is missing, skip to the next */
Index: src/kdc/network.c
===================================================================
--- src/kdc/network.c	(Revision 20580)
+++ src/kdc/network.c	(Revision 20587)
@@ -277,6 +277,12 @@
     struct connection *newconn;
     void *tmp;
 
+    if (sock > FD_SETSIZE) {
+	data->retval = EMFILE;	/* XXX */
+	com_err(data->prog, 0,
+		"file descriptor number %d too high", sock);
+	return 0;
+    }
     newconn = malloc(sizeof(*newconn));
     if (newconn == 0) {
 	data->retval = errno;
@@ -360,6 +366,12 @@
 		paddr(addr));
 	return -1;
     }
+    if (sock > FD_SETSIZE) {
+	close(sock);
+	com_err(data->prog, 0, "TCP socket fd number %d (for %s) too high",
+		sock, paddr(addr));
+	return -1;
+    }
     if (setreuseaddr(sock, 1) < 0)
 	com_err(data->prog, errno,
 		"Cannot enable SO_REUSEADDR on fd %d", sock);
@@ -791,6 +803,10 @@
     s = accept(conn->fd, addr, &addrlen);
     if (s < 0)
 	return;
+    if (s > FD_SETSIZE) {
+	close(s);
+	return;
+    }
     setnbio(s), setnolinger(s);
 
     sockdata.prog = prog;
Index: src/lib/gssapi/krb5/accept_sec_context.c
===================================================================
--- src/lib/gssapi/krb5/accept_sec_context.c	(Revision 20580)
+++ src/lib/gssapi/krb5/accept_sec_context.c	(Revision 20587)
@@ -1,5 +1,5 @@
 /*
- * Copyright 2000, 2004  by the Massachusetts Institute of Technology.
+ * Copyright 2000, 2004, 2008 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -249,6 +249,7 @@
    krb5_data option;
    const gss_OID_desc *mech_used = NULL;
    OM_uint32 major_status = GSS_S_FAILURE;
+   OM_uint32 tmp_minor_status;
    krb5_error krb_error_data;
    krb5_data scratch;
    gss_cred_id_t cred_handle = NULL;
@@ -903,13 +904,14 @@
 
    if (!GSS_ERROR(major_status) && major_status != GSS_S_CONTINUE_NEEDED) {
        ctx->k5_context = context;
-       return(major_status);
+       context = NULL;
+       goto done;
    }
 
    /* from here on is the real "fail" code */
 
    if (ctx)
-       (void) krb5_gss_delete_sec_context(minor_status, 
+       (void) krb5_gss_delete_sec_context(&tmp_minor_status, 
 					  (gss_ctx_id_t *) &ctx, NULL);
    if (deleg_cred) { /* free memory associated with the deleg credential */
        if (deleg_cred->ccache)
@@ -936,10 +938,9 @@
    if (decode_req_message) {
        krb5_ap_req 	* request;
 	   
-       if (decode_krb5_ap_req(&ap_req, &request)) {
-	   krb5_free_context(context);
-	   return (major_status);
-       }
+       if (decode_krb5_ap_req(&ap_req, &request))
+	   goto done;
+
        if (request->ap_options & AP_OPTS_MUTUAL_REQUIRED)
 	   gss_flags |= GSS_C_MUTUAL_FLAG;
        krb5_free_ap_req(context, request);
@@ -967,20 +968,16 @@
        krb_error_data.server = cred->princ;
 
        code = krb5_mk_error(context, &krb_error_data, &scratch);
-       if (code) {
-	   krb5_free_context(context);
-	   return (major_status);
-       }
+       if (code)
+           goto done;
 
        tmsglen = scratch.length;
        toktype = KG_TOK_CTX_ERROR;
 
        token.length = g_token_size(mech_used, tmsglen);
        token.value = (unsigned char *) xmalloc(token.length);
-       if (!token.value) {
-	   krb5_free_context(context);
-	   return (major_status);
-       }
+       if (!token.value) 
+           goto done;
 
        ptr = token.value;
        g_make_token_header(mech_used, tmsglen, &ptr, toktype);
@@ -990,9 +987,13 @@
 
        *output_token = token;
    }
+
+  done:
    if (!verifier_cred_handle && cred_handle) {
-	   krb5_gss_release_cred(minor_status, &cred_handle);
+       krb5_gss_release_cred(&tmp_minor_status, &cred_handle);
    }
-   krb5_free_context(context);
+   if (context) {
+       krb5_free_context(context);
+   }
    return (major_status);
 }
Index: src/lib/comerr32.def
===================================================================
--- src/lib/comerr32.def	(Revision 20580)
+++ src/lib/comerr32.def	(Revision 20587)
@@ -3,10 +3,10 @@
 HEAPSIZE	8192
 
 EXPORTS
-	com_err
-	com_err_va
-	error_message
-	add_error_table
-	remove_error_table
-	set_com_err_hook
-	reset_com_err_hook
+	com_err			@2
+	com_err_va		@3
+	error_message		@4
+	add_error_table	   	@1
+	remove_error_table	@5
+	set_com_err_hook	@6
+	reset_com_err_hook	@7
Index: src/lib/kadm5/srv/svr_principal.c
===================================================================
--- src/lib/kadm5/srv/svr_principal.c	(Revision 20580)
+++ src/lib/kadm5/srv/svr_principal.c	(Revision 20587)
@@ -2099,7 +2099,8 @@
      * inexact match on the enctype; this behavior will go away when
      * the key storage architecture gets redesigned for 1.3.
      */
-    keyblock->enctype = ktype;
+    if (ktype != -1)
+        keyblock->enctype = ktype;
 
     if (kvnop)
 	 *kvnop = key_data->key_data_kvno;
Index: src/lib/krb5/os/sendto_kdc.c
===================================================================
--- src/lib/krb5/os/sendto_kdc.c	(Revision 20580)
+++ src/lib/krb5/os/sendto_kdc.c	(Revision 20587)
@@ -654,6 +654,12 @@
 	dprint("socket: %m creating with af %d\n", state->err, ai->ai_family);
 	return -1;		/* try other hosts */
     }
+    if (fd >= FD_SETSIZE) {
+	close(fd);
+	state->err = EMFILE;
+	dprint("socket: fd %d too high\n", fd);
+	return -1;
+    }
     /* Make it non-blocking.  */
     if (ai->ai_socktype == SOCK_STREAM) {
 	static const int one = 1;

Places

File krb5-1.6.3-post.dif of Package krb5 (Revision 382a3cfe383eff05d5b21b23fefb33d9)

Places