oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

kdc: Check krb5_ret_uint32() in connect loop

Browse Source
This commit is contained in:
Nicolas Williams
2022-01-18 00:42:00 -06:00
parent fcba7a9fd1
commit a1481f1f05
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
kdc/connect.c
View File

@@ -621,6 +621,7 @@ handle_vanilla_tcp (krb5_context context,
krb5_kdc_configuration *config, krb5_kdc_configuration *config,
struct descr *d) struct descr *d)
{ {
krb5_error_code ret;
krb5_storage *sp; krb5_storage *sp;
uint32_t len; uint32_t len;
@@ -629,7 +630,13 @@ handle_vanilla_tcp (krb5_context context,
kdc_log (context, config, 1, "krb5_storage_from_mem failed"); kdc_log (context, config, 1, "krb5_storage_from_mem failed");
return -1; return -1;
} }
krb5_ret_uint32(sp, &len); if (d->len < 4)
return 0;
ret = krb5_ret_uint32(sp, &len);
if (ret) {
kdc_log(context, config, 4, "failed to read request length");
return -1;
}
krb5_storage_free(sp); krb5_storage_free(sp);
if(d->len - 4 >= len) { if(d->len - 4 >= len) {
memmove(d->buf, d->buf + 4, d->len - 4); memmove(d->buf, d->buf + 4, d->len - 4);