830fcd7
--- a/src/lib/gssapi/krb5/accept_sec_context.c
830fcd7
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
830fcd7
@@ -561,6 +561,13 @@ kg_accept_krb5(minor_status, context_handle,
830fcd7
     }
830fcd7
 #endif
830fcd7
 
830fcd7
+   if (authdat->checksum == NULL) {
830fcd7
+      /* missing checksum counts as "inappropriate type" */
830fcd7
+      code = KRB5KRB_AP_ERR_INAPP_CKSUM;
830fcd7
+      major_status = GSS_S_FAILURE;
830fcd7
+      goto fail;
830fcd7
+   }
830fcd7
+
830fcd7
    if (authdat->checksum->checksum_type != CKSUMTYPE_KG_CB) {
830fcd7
       /* Samba does not send 0x8003 GSS-API checksums */
830fcd7
       krb5_boolean valid;