Fix unlikely double free in PKINIT client code

In pa_pkinit_gen_req, if the cleanup handler is reached with non-zero
retval and non-null out_data, out_data is freed, then dereferenced,
then freed again.  This can only happen if one of the small fixed-size
malloc requests fails after pkinit_as_req_create succeeds, so it is
unlikely to occur in practice.

(cherry picked from commit cc002d6c1ccfc08356d01ba83e72a46855d0302c)

ticket: 7878
version_fixed: 1.12.2
status: resolved
Fix returning KDB_NOENTRY in find_alternate_tgs()

After searching for a cross-realm TGS entry to provide to a client as a
referral, if we're all set to return a success code but aren't actually
returning an entry, we should be returning an error.  We might not do so
because we don't compare the right value against NULL.

This corrects an error in a redundant check in the patch for
CVE-2013-1417.  The error in the check cannot occur in practice
because the other part of the patch for CVE-2013-1417 prevents it, but
static analyzers can flag the erroneous check.

[tlyu@mit.edu: edit commit message]

(cherry picked from commit 90cbf4eb60d8ec3c083195ba4a050a31ea36be0b)

ticket: 7881
version_fixed: 1.12.2
status: resolved
Update example kadmin getprinc enctype display

In kadmin_local.rst, update the example to reflect the new way we
display enctypes after #5014.

(cherry picked from commit 3890d1dff87a839efec38a77dcc88574ed65f4a9)

ticket: 7890
version_fixed: 1.12.2
status: resolved
Fix GSS krb5 initial sequence number gap handling

Since #2040, the dummy queue element inserted by g_order_init no
longer compares less than the initial sequence number, so we fail when
the first few sequence numbers are received out of order.  Properly
detect when a sequence number fits between the dummy element and the
first real queue element.

[ghudson@mit.edu: rewrote commit message]

(cherry picked from commit 13a9cb721194c8aa4ccf6ed6ef23e3ac8dd24037)

ticket: 7872
version_fixed: 1.12.2
status: resolved
Get getopt from unistd.h (not getopt.h) in tests

POSIX defines getopt to be declared in unistd.h, and HP-UX (as of
version 11.31) does not appear to have getopt.h.  In test programs
which currently include getopt.h and aren't currently built on
Windows, include unistd.h or just assume we will get it via k5-int.h.

(cherry picked from commit 613c62d689c31a325d51be88657dedd17af3cf81)

ticket: 7894
version_fixed: 1.12.2
status: resolved
Fix leak in kadm5_flush with LDAP KDB

Due to an inverted test in adb_policy_init, kadm5_flush calls
krb5_db_open twice.  With the DB2 KDB module, the second open is a
no-op, but with the LDAP module, a new DB handle is allocated and the
old one is leaked.

[ghudson@mit.edu: rewrote commit message]

(cherry picked from commit 372e4cb6f5d4a603e6e3157c7b5d354953836136)

ticket: 7897
version_fixed: 1.12.2
status: resolved
Check for asprintf failure in kdb5_util create

In add_admin_princ, remove build_name_with_realm and call asprintf
directly instead.  Check for asprintf failure to avoid passing an
undefined pointer to krb5_parse_name.

[ghudson@mit.edu: rewrite commit message]

(cherry picked from commit f5645d30cf83398640c386a612eb6f07c543286f)

ticket: 7902
version_fixed: 1.12.2
status: resolved