d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

heimdal: Fix NULL dereference when mangled realm message

Browse Source 
Fix a NULL dereference in _kadm5_s_init_context() when the client
sends a mangled realm message.

PR:		267912
Reported by:	Robert Morris <rtm@lcs.mit.edu>
MFC after:	3 days
This commit is contained in:
Cy Schubert 2022-11-24 06:22:13 -08:00
parent d7e8666ffb
commit 05bc50bdb1
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
crypto/heimdal/kadmin/server.c
View File

@ -516,7 +516,9 @@ handle_v5(krb5_context contextp,
ret = krb5_read_priv_message(contextp, ac, &fd, &params);
if(ret)
krb5_err(contextp, 1, ret, "krb5_read_priv_message");
_kadm5_unmarshal_params(contextp, &params, &realm_params);
ret = _kadm5_unmarshal_params(contextp, &params, &realm_params);
if(ret)
krb5_err(contextp, 1, ret, "Could not read or parse kadm5 parameters");
}
initial = ticket->ticket.flags.initial;

6
crypto/heimdal/lib/kadm5/marshall.c
View File

@ -335,8 +335,12 @@ _kadm5_unmarshal_params(krb5_context context,
goto out;
params->mask = mask;
if(params->mask & KADM5_CONFIG_REALM)
if (params->mask & KADM5_CONFIG_REALM) {
ret = krb5_ret_string(sp, &params->realm);
if (params->realm == NULL) {
ret = EINVAL;
}
}
out:
krb5_storage_free(sp);