* Daniel Stenberg <daniel_at_haxx.se> [Tue, 6 May 2008 00:00:28 +0200
(CEST)]:
> On Mon, 5 May 2008, Michal Marek wrote:
>
> > Here is a patch for that, it works almost fine except for krb[45],
> > where the APIs take a non-const pointer:
> >
> > krb5.c:131: warning: assignment discards qualifiers from pointer
> > target type
> >
> > What needs to be done is to check whether the various krb libraries
> > don't modify the buffer and then add a cast.
>
> Hypothetically, what is the worst that could happen if we just do the
> cast and one of the krb libs *does* touch the buffer?

A SIGSEGV. :)
Compiler can place const data into read-only memory page, so any attempt
to modify it will result in access violation.

> I just find it very unlikely that a lib would actually do this, and I
> don't think tracking this info down and verifying it sounds like
> much fun...

I have checked gss_seal() sources: they call gss_wrap():
http://loka.it.su.se/fisheye/browse/heimdal/trunk/heimdal/lib/gssapi/mech/gss_seal.c?r=23025
In turn, gss_wrap() takes a const parameter:
http://loka.it.su.se/fisheye/browse/heimdal/trunk/heimdal/lib/gssapi/mech/gss_wrap.c?r=23025
So basically there's nothing to worry about - absense of 'const' could
be explained by an oversight.

--
tetetest tetetest.