Fix unlikely memory error in krb5_rd_cred

If an error occurs in the for loop in krb5_rd_cred_basic (which should
only happen on an ENOMEM), do not leave the caller with a dangling
reference to the freed credential array.

ticket: 7908 (new)
target_version: 1.12.2
Allow GSS mechs to force mechlistMIC in SPNEGO

During a SPNEGO negotiation, if the mechanim used is NTLMSSP and a MIC
was produced internally in the final initiator mechanism token,
Microsoft servers require a mechlistMIC to be produced even when
NTLMSSP was the most preferred mechanism.

In spnego_mech.c, add a helper function check_mic_required which
queries the mechanism to determine whether we might need to produce a
mechlistMIC for interoperability, and sets sc->mic_reqd if so.

This function is called intentionally after every
gss_init_sec_context(), although only the second call can actually
return a meaningful answer.  The first call signals to the NTLMSSP
mechanism that the SPNEGO layer does support forcing a mechlistMIC, so
that the mechanism can avoid puting a MIC in the final initiator token
if forcing a mechlistMIC is not supported.

[ghudson@mit.edu: clarified commit message and code]

ticket: 7907 (new)