PKINIT null pointer deref [CVE-2013-1415]

Don't dereference a null pointer when cleaning up.

The KDC plugin for PKINIT can dereference a null pointer when a
malformed packet causes processing to terminate early, leading to
a crash of the KDC process.  An attacker would need to have a valid
PKINIT certificate or have observed a successful PKINIT authentication,
or an unauthenticated attacker could execute the attack if anonymous
PKINIT is enabled.

CVSSv2 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:P/RL:O/RC:C

This is a minimal commit for pullup; style fixes in a followup.
[kaduk@mit.edu: reformat and edit commit message]

(cherry picked from commit c773d3c775e9b2d88bcdff5f8a8ba88d7ec4e8ed)

ticket: 7570
version_fixed: 1.11.1
status: resolved
Allow multi-hop SAM-2 exchanges

Prior to 1.11, it was possible to do SAM-2 preauth exchanges with
multiple hops by sending repeated preauth-required errors with
different challenges (which is not the way multi-hop exchanges are
described in RFC 6113, but it can still work).  This stopped working
when SAM-2 was converted to a built-in module because of the use_count
field.  Disable the use count for SAM-2 specifically.

ticket: 7571
version_fixed: 1.11.1
status: resolved
Convert success in krb5_chpw_result_code_string

Result code 0 used to be converted properly by krb5_set_password,
though not krb5_change_password; this changed in 1.10 when
krb5int_setpw_result_code_string was folded into
krb5_chpw_result_code_string.  Restore the old behavior, and make it
apply to krb5_change_password as well, by making
krb5_chpw_result_code_string convert result code 0.

[ghudson@mit.edu: commit message]

(cherry picked from commit 316bf74b4696058e2b60c95c9d0fc90d6c2c2ffe)

ticket: 7569
version_fixed: 1.11.1
status: resolved
Fix memory leak closing DIR ccaches

A ccache type's close function is supposed to free the cache container
as well as the type-specific data.  dcc_close was not doing so,
causing a small memory leak each time a ccache is created or
destroyed.

(cherry picked from commit c264c4e824e1abe77806e7bf43ab2641459b7ee9)

ticket: 7574
version_fixed: 1.11.1
status: resolved
Fix fd leak in DIR ccache cursor function

If dcc_ptcursor_next reached the end of a directory, it called free()
on the directory handle instead of closedir(), causing the directory
fd to be leaked.  Call closedir() instead.

(cherry picked from commit c29d5f61af301aa8993b01ed0e3eb4f529d6862c)

ticket: 7573
version_fixed: 1.11.1
status: resolved
Update acknowledgments in README

Also update copyright years.
Update README and patchlevel.h for krb5-1.11.1
add k5memdup()
add libkrad
Add internal KDC_DIR macro

Define KDC_DIR in osconf.hin and use it for paths within the KDC
directory.
add otp plugin
fixup! Add internal KDC_DIR macro