diff options
| author | Greg Hudson <ghudson@mit.edu> | 2020-07-28 12:58:26 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2020-09-09 16:34:44 -0400 |
| commit | 64f4b75a22212681ca293f8f09ddd24b0244d5b4 (patch) | |
| tree | 9c51b377ea34fad65a2568467f382459a0ebba16 | |
| parent | f712fa5a94438096d3c2449babe4aca9c17d7feb (diff) | |
| download | krb5-64f4b75a22212681ca293f8f09ddd24b0244d5b4.zip krb5-64f4b75a22212681ca293f8f09ddd24b0244d5b4.tar.gz krb5-64f4b75a22212681ca293f8f09ddd24b0244d5b4.tar.bz2 | |
Fix input length checking in SPNEGO DER decoding
In get_mech_set(), check the length before reading the first byte, and
decrease the length by the tag byte when reading and verifying the
sequence length.
In get_req_flags(), check the length before reading the first byte,
and check the context tag length after decoding it.
ticket: 8933 (new)
tags: pullup
target_version: 1.18-next
target_version: 1.17-next
| -rw-r--r-- | src/lib/gssapi/spnego/spnego_mech.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 450145d..81d2400 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3461,14 +3461,14 @@ get_mech_set(OM_uint32 *minor_status, unsigned char **buff_in, unsigned char *start; int i; - if (**buff_in != SEQUENCE_OF) + if (buff_length < 1 || **buff_in != SEQUENCE_OF) return (NULL); start = *buff_in; (*buff_in)++; - length = gssint_get_der_length(buff_in, buff_length, &bytes); - if (length < 0 || buff_length - bytes < (unsigned int)length) + length = gssint_get_der_length(buff_in, buff_length - 1, &bytes); + if (length < 0 || buff_length - 1 - bytes < (unsigned int)length) return NULL; major_status = gss_create_empty_oid_set(minor_status, @@ -3548,11 +3548,11 @@ get_req_flags(unsigned char **buff_in, OM_uint32 bodysize, { unsigned int len; - if (**buff_in != (CONTEXT | 0x01)) + if (bodysize < 1 || **buff_in != (CONTEXT | 0x01)) return (0); if (g_get_tag_and_length(buff_in, (CONTEXT | 0x01), - bodysize, &len) < 0) + bodysize, &len) < 0 || len != 4) return GSS_S_DEFECTIVE_TOKEN; if (*(*buff_in)++ != BIT_STRING) |