oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

gsskrb5: CVE-2022-3437 Check the result of _gsskrb5_get_mech()

Browse Source 
We should make sure that the result of 'total_len - mech_len' won't
overflow, and that we don't memcmp() past the end of the buffer.

Samba BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Joseph Sutton
2022-08-15 16:53:55 +12:00
committed by Nicolas Williams
parent ce6d8bbdbb
commit 4aca82c7d0
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/gssapi/krb5/decapsulate.c
View File

@@ -80,6 +80,10 @@ _gssapi_verify_mech_header(u_char **str,
if (mech_len != mech->length)
return GSS_S_BAD_MECH;
if (mech_len > total_len)
return GSS_S_BAD_MECH;
if (p - *str > total_len - mech_len)
return GSS_S_BAD_MECH;
if (ct_memcmp(p,
mech->elements,
mech->length) != 0)