d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

import 1.27 to fix buffer overflow:

Browse Source 
check size of rlen

Obtained from:	Heimdal CVS
This commit is contained in:
Assar Westerlund 2002-10-22 02:13:32 +00:00
parent 1b3f4135a5
commit 5ead950622
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
crypto/heimdal/kadmin/version4.c
View File

@ -41,7 +41,7 @@
#include <krb_err.h>
#include <kadm_err.h>
RCSID("$Id: version4.c,v 1.26 2002/09/10 15:20:46 joda Exp $");
RCSID("$Id: version4.c,v 1.27 2002/10/21 12:35:07 joda Exp $");
#define KADM_NO_OPCODE -1
#define KADM_NO_ENCRYPT -2
@ -822,6 +822,13 @@ decode_packet(krb5_context context,
off += _krb5_get_int(msg + off, &rlen, 4);
memset(&authent, 0, sizeof(authent));
authent.length = message.length - rlen - KADM_VERSIZE - 4;
if(authent.length >= MAX_KTXT_LEN) {
krb5_warnx(context, "received bad rlen (%lu)", (unsigned long)rlen);
make_you_loose_packet (KADM_LENGTH_ERROR, reply);
return;
}
memcpy(authent.dat, (char*)msg + off, authent.length);
off += authent.length;