diff options
Diffstat (limited to 'src/kprop/kpropd.c')
| -rw-r--r-- | src/kprop/kpropd.c | 33 |
1 files changed, 21 insertions, 12 deletions
diff --git a/src/kprop/kpropd.c b/src/kprop/kpropd.c index 46bb9d1..f2341d7 100644 --- a/src/kprop/kpropd.c +++ b/src/kprop/kpropd.c @@ -55,6 +55,7 @@ #include "com_err.h" #include "fake-addrinfo.h" +#include <inttypes.h> #include <locale.h> #include <ctype.h> #include <sys/file.h> @@ -1345,9 +1346,10 @@ static void recv_database(krb5_context context, int fd, int database_fd, krb5_data *confmsg) { - krb5_ui_4 database_size, received_size; + uint64_t database_size, received_size; int n; char buf[1024]; + char dbsize_buf[KPROP_DBSIZE_MAX_BUFSIZ]; krb5_data inbuf, outbuf; krb5_error_code retval; @@ -1369,10 +1371,17 @@ recv_database(krb5_context context, int fd, int database_fd, _("while decoding database size from client")); exit(1); } - memcpy(&database_size, outbuf.data, sizeof(database_size)); + + retval = decode_database_size(&outbuf, &database_size); + if (retval) { + send_error(context, fd, retval, "malformed database size message"); + com_err(progname, retval, + _("malformed database size message from client")); + exit(1); + } + krb5_free_data_contents(context, &inbuf); krb5_free_data_contents(context, &outbuf); - database_size = ntohl(database_size); /* Initialize the initial vector. */ retval = krb5_auth_con_initivector(context, auth_context); @@ -1392,7 +1401,7 @@ recv_database(krb5_context context, int fd, int database_fd, retval = krb5_read_message(context, &fd, &inbuf); if (retval) { snprintf(buf, sizeof(buf), - "while reading database block starting at offset %d", + "while reading database block starting at offset %"PRIu64, received_size); com_err(progname, retval, "%s", buf); send_error(context, fd, retval, buf); @@ -1403,8 +1412,8 @@ recv_database(krb5_context context, int fd, int database_fd, retval = krb5_rd_priv(context, auth_context, &inbuf, &outbuf, NULL); if (retval) { snprintf(buf, sizeof(buf), - "while decoding database block starting at offset %d", - received_size); + "while decoding database block starting at offset %" + PRIu64, received_size); com_err(progname, retval, "%s", buf); send_error(context, fd, retval, buf); krb5_free_data_contents(context, &inbuf); @@ -1414,13 +1423,13 @@ recv_database(krb5_context context, int fd, int database_fd, krb5_free_data_contents(context, &inbuf); if (n < 0) { snprintf(buf, sizeof(buf), - "while writing database block starting at offset %d", + "while writing database block starting at offset %"PRIu64, received_size); send_error(context, fd, errno, buf); } else if ((unsigned int)n != outbuf.length) { snprintf(buf, sizeof(buf), "incomplete write while writing database block starting " - "at \noffset %d (%d written, %d expected)", + "at \noffset %"PRIu64" (%d written, %d expected)", received_size, n, outbuf.length); send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); } @@ -1431,7 +1440,8 @@ recv_database(krb5_context context, int fd, int database_fd, /* OK, we've seen the entire file. Did we get too many bytes? */ if (received_size > database_size) { snprintf(buf, sizeof(buf), - "Received %d bytes, expected %d bytes for database file", + "Received %"PRIu64" bytes, expected %"PRIu64 + " bytes for database file", received_size, database_size); send_error(context, fd, KRB5KRB_ERR_GENERIC, buf); } @@ -1441,9 +1451,8 @@ recv_database(krb5_context context, int fd, int database_fd, /* Create message acknowledging number of bytes received, but * don't send it until kdb5_util returns successfully. */ - database_size = htonl(database_size); - inbuf.data = (char *)&database_size; - inbuf.length = sizeof(database_size); + inbuf = make_data(dbsize_buf, sizeof(dbsize_buf)); + encode_database_size(database_size, &inbuf); retval = krb5_mk_safe(context,auth_context,&inbuf,confmsg,NULL); if (retval) { com_err(progname, retval, "while encoding # of received bytes"); |