d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

heimdal: Fix bus fault when zero-length request received

Browse Source 
Zero length client requests result in a bus fault when attempting to
free malloc()ed pointers within the requests softc. Return an error
when the request is zero length.

PR:		268062
Reported by:	Robert Morris <rtm@lcs.mit.edu>
MFC after:	3 days
This commit is contained in:
Cy Schubert 2022-11-30 16:11:18 -08:00
parent d24b272832
commit 6742ff42ab
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
crypto/heimdal/lib/krb5/read_message.c
View File

@ -55,6 +55,11 @@ krb5_read_message (krb5_context context,
return HEIM_ERR_EOF;
}
len = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
if (len == 0) {
krb5_clear_error_message(context);
return HEIM_ERR_EOF;
}
ret = krb5_data_alloc (data, len);
if (ret) {
krb5_clear_error_message(context);