[31578] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Prevent integer overrun in keytab parsing
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Aug 31 22:48:31 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20260901024825.54936105757@krbdev.mit.edu>
Date: Mon, 31 Aug 2026 22:48:25 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/8eab516421b6b1fee2482194cd4bedcfc552bfeb
commit 8eab516421b6b1fee2482194cd4bedcfc552bfeb
Author: Greg Hudson <ghudson@mit.edu>
Date: Sat Jul 11 19:43:08 2026 -0400
Prevent integer overrun in keytab parsing
In krb5_ktfileint_internal_read_entry(), once we have read the size
and determined the starting point of a keytab record, bounds-check the
size to prevent an integer overflow when we seek to the next record.
(Discovered by OSS-Fuzz.)
(cherry picked from commit c5629fdffee70a296429d580a890e21c6fa17665)
ticket: 9224
version_fixed: 1.22.3
src/lib/krb5/keytab/kt_file.c | 2 ++
src/tests/fuzzing/fuzz_keytab_seed_corpus/big_size | Bin 0 -> 28 bytes
2 files changed, 2 insertions(+)
diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
index 993f902c7..ff9fa2309 100644
--- a/src/lib/krb5/keytab/kt_file.c
+++ b/src/lib/krb5/keytab/kt_file.c
@@ -935,6 +935,8 @@ krb5_ktfileint_internal_read_entry(krb5_context context, krb5_keytab id, krb5_ke
}
start_pos = ftell(KTFILEP(id));
+ if (size > INT32_MAX - start_pos)
+ return KRB5_KT_FORMAT;
/* deal with guts of parsing... */
diff --git a/src/tests/fuzzing/fuzz_keytab_seed_corpus/big_size b/src/tests/fuzzing/fuzz_keytab_seed_corpus/big_size
new file mode 100644
index 000000000..7a1e6c2c5
Binary files /dev/null and b/src/tests/fuzzing/fuzz_keytab_seed_corpus/big_size differ
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
