d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

import 1.29 to fix buffer overflow:

Browse Source 
check the length of the authenticator and rlen

Obtained from:	Heimdal CVS
This commit is contained in:
assar 2002-10-23 06:10:08 +00:00
parent a4ee56e2bb
commit 1b79516e3f
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
crypto/kerberosIV/kadmin/kadm_ser_wrap.c
View File

@ -117,16 +117,25 @@ kadm_ser_in(u_char **dat, int *dat_len, u_char *errdat)
u_char *retdat, *tmpdat;
int retval, retlen;
if (strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE)) {
if (*dat_len < (KADM_VERSIZE + sizeof(u_int32_t))
|| strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE) != 0) {
errpkt(errdat, dat, dat_len, KADM_BAD_VER);
return KADM_BAD_VER;
}
in_len = KADM_VERSIZE;
/* get the length */
if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0)
if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0 ||
(r_len > *dat_len - KADM_VERSIZE - sizeof(u_int32_t))) {
errpkt(errdat, dat, dat_len, KADM_LENGTH_ERROR);
return KADM_LENGTH_ERROR;
}
in_len += retc;
authent.length = *dat_len - r_len - KADM_VERSIZE - sizeof(u_int32_t);
if (authent.length > MAX_KTXT_LEN) {
errpkt(errdat, dat, dat_len, KADM_LENGTH_ERROR);
return KADM_LENGTH_ERROR;
}
memcpy(authent.dat, (char *)(*dat) + in_len, authent.length);
authent.mbz = 0;
/* service key should be set before here */