[31422] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix correctness in LDAP delegation ACL checking
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Tue Apr 22 15:24:31 2025
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20250422192425.6CA8F102D23@krbdev.mit.edu>
Date: Tue, 22 Apr 2025 15:24:25 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/8456b1f0f55fbb42f983df1418c65bef9c71ad66
commit 8456b1f0f55fbb42f983df1418c65bef9c71ad66
Author: Greg Hudson <ghudson@mit.edu>
Date: Fri Apr 11 02:14:57 2025 -0400
Fix correctness in LDAP delegation ACL checking
The LDAP KDB module synthesizes KRB5_TL_CONSTRAINED_DELEGATION_ACL
tl-data when fetching a principal entry, and checks against those
values in krb5_ldap_check_allowed_to_delegate(). To avoid a locally
incorrect use of a counted data type, adjust the synthesized
attributes to include the trailing zero byte in tl_data_length, and
verify the zero terminator before calling krb5_parse_name() on the
value.
src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c | 4 +++-
src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c | 2 +-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
index 342e6df15..d2f872be4 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/kdb_ldap.c
@@ -296,7 +296,9 @@ krb5_ldap_check_allowed_to_delegate(krb5_context context,
for (tlp = server->tl_data; tlp != NULL; tlp = tlp->tl_data_next) {
krb5_principal acl;
- if (tlp->tl_data_type != KRB5_TL_CONSTRAINED_DELEGATION_ACL)
+ if (tlp->tl_data_type != KRB5_TL_CONSTRAINED_DELEGATION_ACL ||
+ tlp->tl_data_length < 1 ||
+ tlp->tl_data_contents[tlp->tl_data_length - 1] != '\0')
continue;
if (krb5_parse_name(context, (char *)tlp->tl_data_contents, &acl) != 0)
diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
index f73f71adc..90b90183b 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_misc.c
@@ -1606,7 +1606,7 @@ populate_krb5_db_entry(krb5_context context, krb5_ldap_context *ldap_context,
if (tl == NULL)
goto cleanup;
tl->tl_data_type = KRB5_TL_CONSTRAINED_DELEGATION_ACL;
- tl->tl_data_length = strlen(a2d2[i]);
+ tl->tl_data_length = strlen(a2d2[i]) + 1;
tl->tl_data_contents = (unsigned char *)strdup(a2d2[i]);
if (tl->tl_data_contents == NULL) {
ret = ENOMEM;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
