[31220] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix potential memory leak in recent commit
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Sun Mar 26 01:53:42 2023
From: ghudson@mit.edu
To: <cvs-krb5@mit.edu>
Message-ID: <20230326054929.E04D2105164@krbdev.mit.edu>
Date: Sun, 26 Mar 2023 01:49:29 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/654f257b8843e3d85e368d8816511d99a8bab987
commit 654f257b8843e3d85e368d8816511d99a8bab987
Author: Greg Hudson <ghudson@mit.edu>
Date: Sun Mar 26 01:32:57 2023 -0400
Fix potential memory leak in recent commit
In get_negTokenInit(), reject a zero-length mechTypes field before
copying it into *der_mechSet, to prevent allocating a zero-length GSS
buffer.
src/lib/gssapi/spnego/spnego_mech.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index bdd75868a..5923c880b 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -3437,8 +3437,9 @@ get_negTokenInit(OM_uint32 *minor_status,
if (!k5_der_get_value(&seq, SEQUENCE, &seq))
return GSS_S_DEFECTIVE_TOKEN;
- /* Get the contents of the mechTypes field. */
- if (!k5_der_get_value(&seq, CONTEXT, &field))
+ /* Get the contents of the mechTypes field. Reject an empty field here
+ * since we musn't allocate a zero-length buffer in the next step. */
+ if (!k5_der_get_value(&seq, CONTEXT, &field) || field.len == 0)
return GSS_S_DEFECTIVE_TOKEN;
/* Store a copy of the contents for MIC computation. */
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
