feeling like an idiot. the original test compared the size of the
ticket field in the ktc_token struct allocated by the app which might
be smaller than the size of the field defined in the library
/* user name is here */
- /* check that ticket will fit */
- if (MAXKTCTICKETLEN < ticketLen)
+ /* check that ticket will fit
+ * this compares the size of the ktc_token allocated by the app
+ * which might be smaller than the current definition of MAXKTCTICKETLEN
+ */
+ maxLen = tokenLen - sizeof(struct ktc_token) + MAXKTCTICKETLEN;
+ if (maxLen < ticketLen)
return KTC_TOOBIG;
/* set return values */