[31587] in CVS-changelog-for-Kerberos-V5
krb5 commit: Validate lengths when deserializing profiles
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Fri Oct 30 13:01:43 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261030065131.7AB38105832@krbdev.mit.edu>
Date: Fri, 30 Oct 2026 02:51:31 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/5281e51e2421d9379f8f2ac654e401d305fac6e7
commit 5281e51e2421d9379f8f2ac654e401d305fac6e7
Author: Bogdan Boguslavskij <bogdanb@altlinux.org>
Date: Mon Aug 31 18:23:28 2026 +0300
Validate lengths when deserializing profiles
Add bounds checks to profile_ser_internalize(), in a similar fashion
to commit 63ae6a8d99ce89258d732f7561233f60df533fa9 for other
deserialization functions.
[ghudson@mit.edu: added a bounds check for fcount; rewrote commit
message]
ticket: 9248 (new)
tags: pullup
target_version: 1.22-next
src/util/profile/prof_init.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/util/profile/prof_init.c b/src/util/profile/prof_init.c
index b97d469a1..54ae6e35f 100644
--- a/src/util/profile/prof_init.c
+++ b/src/util/profile/prof_init.c
@@ -631,6 +631,8 @@ errcode_t profile_ser_internalize(profile_t *profilep,
(void) unpack_int32(&fcount, &bp, &remain);
retval = ENOMEM;
+ if (fcount < 0 || (size_t)fcount > remain)
+ goto cleanup;
flist = (profile_filespec_t *) malloc(sizeof(profile_filespec_t) * (size_t) (fcount + 1));
if (!flist)
goto cleanup;
@@ -638,6 +640,8 @@ errcode_t profile_ser_internalize(profile_t *profilep,
memset(flist, 0, sizeof(char *) * (size_t) (fcount+1));
for (i=0; i<fcount; i++) {
if (!unpack_int32(&tmp, &bp, &remain)) {
+ if (tmp < 0 || (size_t)tmp > remain)
+ goto cleanup;
flist[i] = (char *) malloc((size_t) (tmp+1));
if (!flist[i])
goto cleanup;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
