Work around a possible compiler bug until we find the problem.

diff -ur src/kdc/do_as_req.c src/kdc/do_as_req.c
--- src/kdc/do_as_req.c	Tue May 29 15:47:34 2001
+++ src/kdc/do_as_req.c	Tue May 29 15:44:27 2001
@@ -156,7 +156,7 @@
 	goto errout;
     }
 
-    if ((errcode = validate_as_request(request, client, server,
+    if ((errcode = validate_as_request(request, &client, &server,
 				      kdc_time, &status))) {
 	if (!status) 
 	    status = "UNKNOWN_REASON";
diff -ur src/kdc/do_tgs_req.c src/kdc/do_tgs_req.c
--- src/kdc/do_tgs_req.c	Tue May 29 15:47:48 2001
+++ src/kdc/do_tgs_req.c	Tue May 29 15:44:27 2001
@@ -196,7 +196,7 @@
 	goto cleanup;
     }
     
-    if ((retval = validate_tgs_request(request, server, header_ticket,
+    if ((retval = validate_tgs_request(request, &server, header_ticket,
 				      kdc_time, &status))) {
 	if (!status)
 	    status = "UNKNOWN_REASON";
diff -ur src/kdc/kdc_util.c src/kdc/kdc_util.c
--- src/kdc/kdc_util.c	Tue May 29 15:46:37 2001
+++ src/kdc/kdc_util.c	Tue May 29 15:44:27 2001
@@ -532,9 +532,9 @@
  *                                  ticket.  This is the realm that is
  *                                  to be added to the transited field.
  *            krb5_principal client Name of the client
- *            krb5_principal server The name of the requested server.
+ *            krb5_principal server The name of the requested server->
  *                                  This may be the an intermediate
- *                                  ticket granting server.
+ *                                  ticket granting server->
  *
  *            The last two argument are needed since they are
  *            implicitly part of the transited field of the new ticket
@@ -854,8 +854,8 @@
 int
 validate_as_request(request, client, server, kdc_time, status)
 register krb5_kdc_req *request;
-krb5_db_entry client;
-krb5_db_entry server;
+krb5_db_entry *client;
+krb5_db_entry *server;
 krb5_timestamp kdc_time;
 const char	**status;
 {
@@ -871,8 +871,8 @@
 
     /* The client's password must not be expired, unless the server is
       a KRB5_KDC_PWCHANGE_SERVICE. */
-    if (client.pw_expiration && client.pw_expiration < kdc_time &&
-	!isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) {
+    if (client->pw_expiration && client->pw_expiration < kdc_time &&
+	!isflagset(server->attributes, KRB5_KDB_PWCHANGE_SERVICE)) {
 	*status = "CLIENT KEY EXPIRED";
 #ifdef KRBCONF_VAGUE_ERRORS
 	return(KRB_ERR_GENERIC);
@@ -882,7 +882,7 @@
     }
 
     /* The client must not be expired */
-    if (client.expiration && client.expiration < kdc_time) {
+    if (client->expiration && client->expiration < kdc_time) {
 	*status = "CLIENT EXPIRED";
 #ifdef KRBCONF_VAGUE_ERRORS
 	return(KRB_ERR_GENERIC);
@@ -892,7 +892,7 @@
     }
 
     /* The server must not be expired */
-    if (server.expiration && server.expiration < kdc_time) {
+    if (server->expiration && server->expiration < kdc_time) {
 	*status = "SERVICE EXPIRED";
 	    return(KDC_ERR_SERVICE_EXP);
     }
@@ -901,8 +901,8 @@
      * If the client requires password changing, then only allow the 
      * pwchange service.
      */
-    if (isflagset(client.attributes, KRB5_KDB_REQUIRES_PWCHANGE) &&
-	!isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) {
+    if (isflagset(client->attributes, KRB5_KDB_REQUIRES_PWCHANGE) &&
+	!isflagset(server->attributes, KRB5_KDB_PWCHANGE_SERVICE)) {
 	*status = "REQUIRED PWCHANGE";
 	return(KDC_ERR_KEY_EXP);
     }
@@ -910,50 +910,50 @@
     /* Client and server must allow postdating tickets */
     if ((isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) ||
 	 isflagset(request->kdc_options, KDC_OPT_POSTDATED)) && 
-	(isflagset(client.attributes, KRB5_KDB_DISALLOW_POSTDATED) ||
-	 isflagset(server.attributes, KRB5_KDB_DISALLOW_POSTDATED))) {
+	(isflagset(client->attributes, KRB5_KDB_DISALLOW_POSTDATED) ||
+	 isflagset(server->attributes, KRB5_KDB_DISALLOW_POSTDATED))) {
 	*status = "POSTDATE NOT ALLOWED";
 	return(KDC_ERR_CANNOT_POSTDATE);
     }
     
     /* Client and server must allow forwardable tickets */
     if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE) &&
-	(isflagset(client.attributes, KRB5_KDB_DISALLOW_FORWARDABLE) ||
-	 isflagset(server.attributes, KRB5_KDB_DISALLOW_FORWARDABLE))) {
+	(isflagset(client->attributes, KRB5_KDB_DISALLOW_FORWARDABLE) ||
+	 isflagset(server->attributes, KRB5_KDB_DISALLOW_FORWARDABLE))) {
 	*status = "FORWARDABLE NOT ALLOWED";
 	return(KDC_ERR_POLICY);
     }
     
     /* Client and server must allow renewable tickets */
     if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE) &&
-	(isflagset(client.attributes, KRB5_KDB_DISALLOW_RENEWABLE) ||
-	 isflagset(server.attributes, KRB5_KDB_DISALLOW_RENEWABLE))) {
+	(isflagset(client->attributes, KRB5_KDB_DISALLOW_RENEWABLE) ||
+	 isflagset(server->attributes, KRB5_KDB_DISALLOW_RENEWABLE))) {
 	*status = "RENEWABLE NOT ALLOWED";
 	return(KDC_ERR_POLICY);
     }
     
     /* Client and server must allow proxiable tickets */
     if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE) &&
-	(isflagset(client.attributes, KRB5_KDB_DISALLOW_PROXIABLE) ||
-	 isflagset(server.attributes, KRB5_KDB_DISALLOW_PROXIABLE))) {
+	(isflagset(client->attributes, KRB5_KDB_DISALLOW_PROXIABLE) ||
+	 isflagset(server->attributes, KRB5_KDB_DISALLOW_PROXIABLE))) {
 	*status = "PROXIABLE NOT ALLOWED";
 	return(KDC_ERR_POLICY);
     }
     
     /* Check to see if client is locked out */
-    if (isflagset(client.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
+    if (isflagset(client->attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
 	*status = "CLIENT LOCKED OUT";
 	return(KDC_ERR_C_PRINCIPAL_UNKNOWN);
     }
 
     /* Check to see if server is locked out */
-    if (isflagset(server.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
+    if (isflagset(server->attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
 	*status = "SERVICE LOCKED OUT";
 	return(KDC_ERR_S_PRINCIPAL_UNKNOWN);
     }
 	
     /* Check to see if server is allowed to be a service */
-    if (isflagset(server.attributes, KRB5_KDB_DISALLOW_SVR)) {
+    if (isflagset(server->attributes, KRB5_KDB_DISALLOW_SVR)) {
 	*status = "SERVICE NOT ALLOWED";
 	return(KDC_ERR_S_PRINCIPAL_UNKNOWN);
     }
@@ -961,7 +961,7 @@
     /*
      * Check against local policy
      */
-    errcode = against_local_policy_as(request, server, client,
+    errcode = against_local_policy_as(request, *server, *client,
 				      kdc_time, status); 
     if (errcode)
 	return errcode;
@@ -1135,7 +1135,7 @@
 int
 validate_tgs_request(request, server, ticket, kdc_time, status)
 register krb5_kdc_req *request;
-krb5_db_entry server;
+krb5_db_entry *server;
 krb5_ticket *ticket;
 krb5_timestamp kdc_time;
 const char **status;
@@ -1152,7 +1152,7 @@
     }
     
     /* Check to see if server has expired */
-    if (server.expiration && server.expiration < kdc_time) {
+    if (server->expiration && server->expiration < kdc_time) {
 	*status = "SERVICE EXPIRED";
 	return(KDC_ERR_SERVICE_EXP);
     }
@@ -1206,7 +1206,7 @@
 	 */
 
 	/* Server must allow TGS based issuances */
-	if (isflagset(server.attributes, KRB5_KDB_DISALLOW_TGT_BASED)) {
+	if (isflagset(server->attributes, KRB5_KDB_DISALLOW_TGT_BASED)) {
 	    *status = "TGT BASED NOT ALLOWED";
 	    return(KDC_ERR_POLICY);
 	}
@@ -1264,47 +1264,47 @@
     
     /* Server must allow forwardable tickets */
     if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE) &&
-	isflagset(server.attributes, KRB5_KDB_DISALLOW_FORWARDABLE)) {
+	isflagset(server->attributes, KRB5_KDB_DISALLOW_FORWARDABLE)) {
 	*status = "NON-FORWARDABLE TICKET";
 	return(KDC_ERR_POLICY);
     }
     
     /* Server must allow renewable tickets */
     if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE) &&
-	isflagset(server.attributes, KRB5_KDB_DISALLOW_RENEWABLE)) {
+	isflagset(server->attributes, KRB5_KDB_DISALLOW_RENEWABLE)) {
 	*status = "NON-RENEWABLE TICKET";
 	return(KDC_ERR_POLICY);
     }
     
     /* Server must allow proxiable tickets */
     if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE) &&
-	isflagset(server.attributes, KRB5_KDB_DISALLOW_PROXIABLE)) {
+	isflagset(server->attributes, KRB5_KDB_DISALLOW_PROXIABLE)) {
 	*status = "NON-PROXIABLE TICKET";
 	return(KDC_ERR_POLICY);
     }
     
     /* Server must allow postdated tickets */
     if (isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) &&
-	isflagset(server.attributes, KRB5_KDB_DISALLOW_POSTDATED)) {
+	isflagset(server->attributes, KRB5_KDB_DISALLOW_POSTDATED)) {
 	*status = "NON-POSTDATABLE TICKET";
 	return(KDC_ERR_CANNOT_POSTDATE);
     }
     
     /* Server must allow DUP SKEY requests */
     if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY) &&
-	isflagset(server.attributes, KRB5_KDB_DISALLOW_DUP_SKEY)) {
+	isflagset(server->attributes, KRB5_KDB_DISALLOW_DUP_SKEY)) {
 	*status = "DUP_SKEY DISALLOWED";
 	return(KDC_ERR_POLICY);
     }
 
     /* Server must not be locked out */
-    if (isflagset(server.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
+    if (isflagset(server->attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
 	*status = "SERVER LOCKED OUT";
 	return(KDC_ERR_S_PRINCIPAL_UNKNOWN);
     }
 	
     /* Server must be allowed to be a service */
-    if (isflagset(server.attributes, KRB5_KDB_DISALLOW_SVR)) {
+    if (isflagset(server->attributes, KRB5_KDB_DISALLOW_SVR)) {
 	*status = "SERVER NOT ALLOWED";
 	return(KDC_ERR_S_PRINCIPAL_UNKNOWN);
     }
@@ -1354,14 +1354,14 @@
     }
 
     /* Check for hardware preauthentication */
-    if (isflagset(server.attributes, KRB5_KDB_REQUIRES_HW_AUTH) &&
+    if (isflagset(server->attributes, KRB5_KDB_REQUIRES_HW_AUTH) &&
 	!isflagset(ticket->enc_part2->flags,TKT_FLG_HW_AUTH)) {
 	*status = "NO HW PREAUTH";
 	return KRB_ERR_GENERIC;
     }
 
     /* Check for any kind of preauthentication */
-    if (isflagset(server.attributes, KRB5_KDB_REQUIRES_PRE_AUTH) &&
+    if (isflagset(server->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) &&
 	!isflagset(ticket->enc_part2->flags, TKT_FLG_PRE_AUTH)) {
 	*status = "NO PREAUTH";
 	return KRB_ERR_GENERIC;
@@ -1370,7 +1370,7 @@
     /*
      * Check local policy
      */
-    errcode = against_local_policy_tgs(request, server, ticket, status);
+    errcode = against_local_policy_tgs(request, *server, ticket, status);
     if (errcode)
 	return errcode;
     
diff -ur src/kdc/kdc_util.h src/kdc/kdc_util.h
--- src/kdc/kdc_util.h	Tue May 29 15:47:15 2001
+++ src/kdc/kdc_util.h	Tue May 29 15:44:27 2001
@@ -65,11 +65,11 @@
 					      krb5_keyblock **,
 					      krb5_kvno *));
 
-int validate_as_request PROTOTYPE((krb5_kdc_req *, krb5_db_entry, 
-					  krb5_db_entry, krb5_timestamp,
+int validate_as_request PROTOTYPE((krb5_kdc_req *, krb5_db_entry *, 
+					  krb5_db_entry *, krb5_timestamp,
 					  const char **));
 
-int validate_tgs_request PROTOTYPE((krb5_kdc_req *, krb5_db_entry, 
+int validate_tgs_request PROTOTYPE((krb5_kdc_req *, krb5_db_entry *, 
 					  krb5_ticket *, krb5_timestamp,
 					  const char **));
 
