oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

(krb5_pac_add_buffer): unbreak buffer handling.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@19824 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2007-01-11 02:08:01 +00:00
parent acb8c4e906
commit f35bfaa82e
1 changed files with 15 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
lib/krb5/pac.c
View File

@@ -252,12 +252,10 @@ krb5_pac_add_buffer(krb5_context context, struct krb5_pac *p,
{ {
krb5_error_code ret; krb5_error_code ret;
void *ptr; void *ptr;
size_t len, offset, header_end; size_t len, offset, header_end, old_end;
uint32_t i; uint32_t i;
len = p->pac->numbuffers + 1; len = p->pac->numbuffers;
if (len < p->pac->numbuffers)
return EINVAL;
ptr = realloc(p->pac, ptr = realloc(p->pac,
sizeof(*p->pac) + (sizeof(p->pac->buffers[0]) * len)); sizeof(*p->pac) + (sizeof(p->pac->buffers[0]) * len));
@@ -272,11 +270,12 @@ krb5_pac_add_buffer(krb5_context context, struct krb5_pac *p,
offset = p->data.length + PAC_INFO_BUFFER_SIZE; offset = p->data.length + PAC_INFO_BUFFER_SIZE;
p->pac->buffers[len - 1].type = type; p->pac->buffers[len].type = type;
p->pac->buffers[len - 1].buffersize = data->length; p->pac->buffers[len].buffersize = data->length;
p->pac->buffers[len - 1].offset_lo = offset; p->pac->buffers[len].offset_lo = offset;
p->pac->buffers[len - 1].offset_hi = 0; p->pac->buffers[len].offset_hi = 0;
old_end = p->data.length;
len = p->data.length + data->length + PAC_INFO_BUFFER_SIZE; len = p->data.length + data->length + PAC_INFO_BUFFER_SIZE;
if (len < p->data.length) { if (len < p->data.length) {
krb5_set_error_string(context, "integer overrun"); krb5_set_error_string(context, "integer overrun");
@@ -292,14 +291,17 @@ krb5_pac_add_buffer(krb5_context context, struct krb5_pac *p,
return ret; return ret;
} }
/* make place for PAC INFO BUFFER header */ /*
* make place for new PAC INFO BUFFER header
*/
header_end = PACTYPE_SIZE + (PAC_INFO_BUFFER_SIZE * p->pac->numbuffers); header_end = PACTYPE_SIZE + (PAC_INFO_BUFFER_SIZE * p->pac->numbuffers);
memmove((unsigned char *)p->data.data + header_end, memmove((unsigned char *)p->data.data + header_end + PAC_INFO_BUFFER_SIZE,
(unsigned char *)p->data.data + header_end + PAC_INFO_BUFFER_SIZE, (unsigned char *)p->data.data + header_end ,
PAC_INFO_BUFFER_SIZE); old_end - header_end);
memset((unsigned char *)p->data.data + header_end, 0, PAC_INFO_BUFFER_SIZE);
/* /*
* * copy in new data part
*/ */
memcpy((unsigned char *)p->data.data + offset, memcpy((unsigned char *)p->data.data + offset,