oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

sanon: Fix export/import_cred mismatch

Browse Source 
SANON cred export/import never worked correctly as the export function was
producing the wrong form of token, which was leading gss_import_cred() to
allocate more than 64MB of memory to parse the SANON exported credential.  The
recent change to reduce the default `max_alloc` of krb5_storage exposed this.
This commit is contained in:
Nicolas Williams
2023-01-05 16:58:57 -06:00
parent 561c60ca29
commit b87b813fee
1 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
lib/gssapi/sanon/export_cred.c
View File

@@ -36,5 +36,43 @@ _gss_sanon_export_cred(OM_uint32 *minor,
gss_cred_id_t input_cred,
gss_buffer_t token)
{
return _gss_sanon_export_name(minor, (gss_name_t)input_cred, token);
gss_buffer_desc buf;
krb5_storage *sp;
krb5_data data_out, data;
OM_uint32 major, junk;
token->value = NULL;
token->length = 0;
major = _gss_sanon_export_name(minor, (gss_name_t)input_cred, &buf);
if (major)
return major;
sp = krb5_storage_emem();
if (sp == NULL) {
gss_release_buffer(&junk, &buf);
*minor = ENOMEM;
return GSS_S_FAILURE;
}
major = _gss_mg_store_oid(minor, sp, GSS_SANON_X25519_MECHANISM);
if (major) {
gss_release_buffer(&junk, &buf);
krb5_storage_free(sp);
return major;
}
data_out.length = 0;
data_out.data = NULL;
data.length = buf.length;
data.data = buf.value;
*minor = krb5_store_data(sp, data);
if (*minor == 0)
*minor = krb5_storage_to_data(sp, &data_out);
if (*minor == 0) {
token->value = data_out.data;
token->length = data_out.length;
}
gss_release_buffer(&junk, &buf);
krb5_storage_free(sp);
return major;
}