From 05bc50bdb1c1ddbbeb853ea4b184aced0eca9b3f Mon Sep 17 00:00:00 2001 From: Cy Schubert Date: Thu, 24 Nov 2022 06:22:13 -0800 Subject: [PATCH] heimdal: Fix NULL dereference when mangled realm message Fix a NULL dereference in _kadm5_s_init_context() when the client sends a mangled realm message. PR: 267912 Reported by: Robert Morris MFC after: 3 days --- crypto/heimdal/kadmin/server.c | 4 +++- crypto/heimdal/lib/kadm5/marshall.c | 6 +++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/crypto/heimdal/kadmin/server.c b/crypto/heimdal/kadmin/server.c index 256c2bac89b7..2800a2e1fc29 100644 --- a/crypto/heimdal/kadmin/server.c +++ b/crypto/heimdal/kadmin/server.c @@ -516,7 +516,9 @@ handle_v5(krb5_context contextp, ret = krb5_read_priv_message(contextp, ac, &fd, ¶ms); if(ret) krb5_err(contextp, 1, ret, "krb5_read_priv_message"); - _kadm5_unmarshal_params(contextp, ¶ms, &realm_params); + ret = _kadm5_unmarshal_params(contextp, ¶ms, &realm_params); + if(ret) + krb5_err(contextp, 1, ret, "Could not read or parse kadm5 parameters"); } initial = ticket->ticket.flags.initial; diff --git a/crypto/heimdal/lib/kadm5/marshall.c b/crypto/heimdal/lib/kadm5/marshall.c index 65804afbf92b..38b9855021b2 100644 --- a/crypto/heimdal/lib/kadm5/marshall.c +++ b/crypto/heimdal/lib/kadm5/marshall.c @@ -335,8 +335,12 @@ _kadm5_unmarshal_params(krb5_context context, goto out; params->mask = mask; - if(params->mask & KADM5_CONFIG_REALM) + if (params->mask & KADM5_CONFIG_REALM) { ret = krb5_ret_string(sp, ¶ms->realm); + if (params->realm == NULL) { + ret = EINVAL; + } + } out: krb5_storage_free(sp);