heimdal-7.7.1 and heimdal-7.8.0 are missing CVE-2022-42898 fix

[riastradh]

Describe the bug
The Heimdal 7.7.1 release notes say:

This release fixes the following Security Vulnerabilities:

• CVE-2022-42898 PAC parse integer overflows

Likewise the Heimdal 7.8.0 release notes:

This release includes both the Heimdal 7.7.1 Security Vulnerability fixes and non-Security bug fixes/improvements.

Security Vulnerabilities:

• CVE-2022-42898 PAC parse integer overflows

However, the fix does not appear to have been applied in the heimdal-7.7.1 tag (https://github.com/heimdal/heimdal/blob/heimdal-7.7.1/lib/krb5/store-int.c#L52):

heimdal/lib/krb5/store-int.c

Line 52 in 78077c3

unsigned long v = 0;

Nor does it appear to have been applied in the heimdal-7.8.0 tag (https://github.com/heimdal/heimdal/blob/heimdal-7.8.0/lib/krb5/store-int.c#L52):

heimdal/lib/krb5/store-int.c

Line 52 in a6cf945

unsigned long v = 0;

Compare master as of today:

heimdal/lib/krb5/store-int.c

Line 52 in 1b954fa

uint64_t v = 0;

To Reproduce
code inspection

Expected behavior
fix exists on 7.7.1 and 7.8.0 (well, a bit late for that now, but maybe 7.7.2 and 7.8.1, along with the CVE-2022-45142 fix?)

[riastradh]

Ping? I know the dominant platforms these days are LP64 and thus unaffected by this, but it is a security issue for anyone on LP32 like i386 and armv7 and the release notes appear to be misleading users into thinking it's fixed.

[nicowilliams]

Thanks for this report. I don't know how that happened, but we'll prep new releases.