diff options
| author | Tom Yu <tlyu@mit.edu> | 2013-01-11 15:53:23 -0500 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2013-01-11 15:54:58 -0500 |
| commit | 8e31374995eaa4515323e56d1579ee7ad0ebc4ca (patch) | |
| tree | 057cc1522c39ebcd0f9c859923af78fd25af2215 /src/lib | |
| parent | 9bbf3649867f444674716941b787f6699885c803 (diff) | |
| download | krb5-8e31374995eaa4515323e56d1579ee7ad0ebc4ca.zip krb5-8e31374995eaa4515323e56d1579ee7ad0ebc4ca.tar.gz krb5-8e31374995eaa4515323e56d1579ee7ad0ebc4ca.tar.bz2 | |
Fix various integer issues
In kdc_util.c and spnego_mech.c, error returns from ASN.1 length
functions could be ignored because they were assigned to unsigned
values. In spnego_mech.c, two buffer size checks could be rewritten
to reduce the likelihood of pointer overflow. In dump.c and
kdc_preauth.c, calloc() could be used to simplify the code and avoid
multiplication overflow. In pkinit_clnt.c, the wrong value was
checked for a null result from malloc(), and the code could be
simplified.
Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>.
(cherry picked from commit d3c5450ddf0b20855e86dab41735d56c6860156b)
[tlyu@mit.edu: omitted pkinit and kdb5_util fixes because they're not
conservative]
ticket: 7545 (new)
version_fixed: 1.10.4
status: resolved
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/gssapi/spnego/spnego_mech.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 8665d4f..f916e49 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3957,7 +3957,7 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size) { unsigned char *buf = *buf_in; unsigned char *endptr = buf + cur_size; - unsigned int seqsize; + int seqsize; int ret = 0; unsigned int bytes; @@ -3981,7 +3981,7 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size) /* * Make sure we have the entire buffer as described */ - if (buf + seqsize > endptr) + if (seqsize > endptr - buf) return (G_BAD_TOK_HEADER); } else { return (G_BAD_TOK_HEADER); @@ -3998,7 +3998,7 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size) /* * Make sure we have the entire buffer as described */ - if (buf + bytes > endptr) + if (seqsize > endptr - buf) return (G_BAD_TOK_HEADER); } else { return (G_BAD_TOK_HEADER); |