diff options
| author | Greg Hudson <ghudson@mit.edu> | 2020-07-28 12:58:26 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2020-11-03 11:55:03 -0500 |
| commit | 9e65436cb03d6f0ec93c6fdef68af8ed6077e997 (patch) | |
| tree | 997cc477518526e1063b22d673d39b6f18adc5fc | |
| parent | 75ae7431dbefc4b2ec082a4cfe3f65749fde0fda (diff) | |
| download | krb5-9e65436cb03d6f0ec93c6fdef68af8ed6077e997.zip krb5-9e65436cb03d6f0ec93c6fdef68af8ed6077e997.tar.gz krb5-9e65436cb03d6f0ec93c6fdef68af8ed6077e997.tar.bz2 | |
Fix input length checking in SPNEGO DER decoding
In get_mech_set(), check the length before reading the first byte, and
decrease the length by the tag byte when reading and verifying the
sequence length.
In get_req_flags(), check the length before reading the first byte,
and check the context tag length after decoding it.
(cherry picked from commit 64f4b75a22212681ca293f8f09ddd24b0244d5b4)
ticket: 8933
version_fixed: 1.17.2
| -rw-r--r-- | src/lib/gssapi/spnego/spnego_mech.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 24c94a7..d409245 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3381,14 +3381,14 @@ get_mech_set(OM_uint32 *minor_status, unsigned char **buff_in, unsigned char *start; int i; - if (**buff_in != SEQUENCE_OF) + if (buff_length < 1 || **buff_in != SEQUENCE_OF) return (NULL); start = *buff_in; (*buff_in)++; - length = gssint_get_der_length(buff_in, buff_length, &bytes); - if (length < 0 || buff_length - bytes < (unsigned int)length) + length = gssint_get_der_length(buff_in, buff_length - 1, &bytes); + if (length < 0 || buff_length - 1 - bytes < (unsigned int)length) return NULL; major_status = gss_create_empty_oid_set(minor_status, @@ -3468,11 +3468,11 @@ get_req_flags(unsigned char **buff_in, OM_uint32 bodysize, { unsigned int len; - if (**buff_in != (CONTEXT | 0x01)) + if (bodysize < 1 || **buff_in != (CONTEXT | 0x01)) return (0); if (g_get_tag_and_length(buff_in, (CONTEXT | 0x01), - bodysize, &len) < 0) + bodysize, &len) < 0 || len != 4) return GSS_S_DEFECTIVE_TOKEN; if (*(*buff_in)++ != BIT_STRING) |