[31377] in CVS-changelog-for-Kerberos-V5
krb5 commit: Prevent undefined shift in decode_krb5_flags()
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 11 16:38:33 2024
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20241111213826.C0E9810195D@krbdev.mit.edu>
Date: Mon, 11 Nov 2024 16:38:26 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/d09433aed821d40142b10dc5b4a0aa8110c5a09e
commit d09433aed821d40142b10dc5b4a0aa8110c5a09e
Author: Greg Hudson <ghudson@mit.edu>
Date: Wed Nov 6 17:31:37 2024 -0500
Prevent undefined shift in decode_krb5_flags()
In the statement "f |= bits[i] << (8 * (3 - i))", bits[i] is
implicitly promoted from uint8_t to int according to the integer
promotion rules (C99 6.3.1.1). If i is 0 and bits[i] >= 128, the
result cannot be represented as an int and the behavior of the shift
is undefined (C99 6.5.7). To ensure that the shift operation is
defined, cast bits[i] to uint32_t.
(f and the function output are int32_t, but the conversion of uint32_t
to int32_t is implementation-defined when the value cannot be
represented, not undefined. We check in configure.ac that the
platform is two's complement.)
(Discovered by OSS-Fuzz.)
src/lib/krb5/asn.1/asn1_k_encode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
index ad5a18a24..1a250c98c 100644
--- a/src/lib/krb5/asn.1/asn1_k_encode.c
+++ b/src/lib/krb5/asn.1/asn1_k_encode.c
@@ -250,7 +250,7 @@ decode_krb5_flags(const taginfo *t, const uint8_t *asn1, size_t len, void *val)
return ret;
/* Copy up to 32 bits into f, starting at the most significant byte. */
for (i = 0; i < blen && i < 4; i++)
- f |= bits[i] << (8 * (3 - i));
+ f |= (uint32_t)bits[i] << (8 * (3 - i));
*(krb5_flags *)val = f;
free(bits);
return 0;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
