[31588] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix two KDB data validation issues
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Fri Oct 30 13:01:43 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261030065126.6B466105832@krbdev.mit.edu>
Date: Fri, 30 Oct 2026 02:51:26 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/48adb434dfd4807fc84187e46bf09ef4ee42377c
commit 48adb434dfd4807fc84187e46bf09ef4ee42377c
Author: Bogdan Boguslavskij <bogdanb@altlinux.org>
Date: Fri Sep 4 12:46:23 2026 +0300
Fix two KDB data validation issues
In the LMDB KDB module, fix a bug in klmdb_decode_princ() that
renders the key_data_ver validity check inoperable.
In the DB2 KDB module, bounds-check entry->e_length against the
remaining record data, and decrease sizeleft when we increase nextloc.
[ghudson@mit.edu: combined two commits and rewrote commit message]
ticket: 9250 (new)
tags: pullup
target_version: 1.22-next
src/plugins/kdb/db2/kdb_xdr.c | 5 +++++
src/plugins/kdb/lmdb/marshal.c | 2 +-
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/plugins/kdb/db2/kdb_xdr.c b/src/plugins/kdb/db2/kdb_xdr.c
index 054a87a37..b4666a95b 100644
--- a/src/plugins/kdb/db2/kdb_xdr.c
+++ b/src/plugins/kdb/db2/kdb_xdr.c
@@ -313,10 +313,15 @@ krb5_decode_princ_entry(krb5_context context, krb5_data *content,
/* Check for extra data */
if (entry->len > KRB5_KDB_V1_BASE_LENGTH) {
entry->e_length = entry->len - KRB5_KDB_V1_BASE_LENGTH;
+ if (entry->e_length > (size_t)sizeleft) {
+ retval = KRB5_KDB_TRUNCATED_RECORD;
+ goto error_out;
+ }
entry->e_data = k5memdup(nextloc, entry->e_length, &retval);
if (entry->e_data == NULL)
goto error_out;
nextloc += entry->e_length;
+ sizeleft -= entry->e_length;
}
/*
diff --git a/src/plugins/kdb/lmdb/marshal.c b/src/plugins/kdb/lmdb/marshal.c
index 433bb816d..5aab37491 100644
--- a/src/plugins/kdb/lmdb/marshal.c
+++ b/src/plugins/kdb/lmdb/marshal.c
@@ -215,7 +215,7 @@ klmdb_decode_princ(krb5_context context, const void *key, size_t key_len,
kd = &entry->key_data[i];
kd->key_data_ver = k5_input_get_uint16_le(&in);
kd->key_data_kvno = k5_input_get_uint16_le(&in);
- if (kd->key_data_ver < 0 &&
+ if (kd->key_data_ver < 0 ||
kd->key_data_ver > KRB5_KDB_V1_KEY_DATA_ARRAY) {
ret = KRB5_KDB_BAD_VERSION;
goto cleanup;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
