diff options
author | Greg Hudson <ghudson@mit.edu> | 2017-04-14 21:41:20 -0400 |
---|---|---|
committer | Greg Hudson <ghudson@mit.edu> | 2017-07-17 17:46:04 -0400 |
commit | 2514453d616bafe47beacc73f695ae6d4701ae19 (patch) | |
tree | 1323735ee1a434e7a6ed22b5b4473169e82d4ad0 | |
parent | 39a8a84b9bc880ef2879667f93c18b4d1b989eff (diff) | |
download | krb5-2514453d616bafe47beacc73f695ae6d4701ae19.zip krb5-2514453d616bafe47beacc73f695ae6d4701ae19.tar.gz krb5-2514453d616bafe47beacc73f695ae6d4701ae19.tar.bz2 |
Make RC4 string-to-key more robust
krb5int_utf8cs_to_ucs2les() can read slightly beyond the end of the
input buffer if the buffer ends with an invalid UTF-8 sequence. When
computing the RC4 string-to-key result, make a zero-terminated copy of
the input string and use krb5int_utf8s_to_ucs2les() instead.
(cherry picked from commit b8814745049b5f401e3ae39a81dc1e14598ae48c)
ticket: 8576
version_fixed: 1.14.6
-rw-r--r-- | src/lib/crypto/krb/s2k_rc4.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/lib/crypto/krb/s2k_rc4.c b/src/lib/crypto/krb/s2k_rc4.c index 49ad89d..7286637 100644 --- a/src/lib/crypto/krb/s2k_rc4.c +++ b/src/lib/crypto/krb/s2k_rc4.c @@ -10,6 +10,7 @@ krb5int_arcfour_string_to_key(const struct krb5_keytypes *ktp, krb5_error_code err = 0; krb5_crypto_iov iov; krb5_data hash_out; + char *utf8; unsigned char *copystr; size_t copystrlen; @@ -20,8 +21,11 @@ krb5int_arcfour_string_to_key(const struct krb5_keytypes *ktp, return (KRB5_BAD_MSIZE); /* We ignore salt per the Microsoft spec. */ - err = krb5int_utf8cs_to_ucs2les(string->data, string->length, ©str, - ©strlen); + utf8 = k5memdup0(string->data, string->length, &err); + if (utf8 == NULL) + return err; + err = krb5int_utf8s_to_ucs2les(utf8, ©str, ©strlen); + free(utf8); if (err) return err; |