[31598] in CVS-changelog-for-Kerberos-V5
krb5 commit: Prevent unsigned integer overflow in IAKERB
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Sun Nov 1 01:28:08 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261101062801.2A57B105819@krbdev.mit.edu>
Date: Sun, 1 Nov 2026 01:28:01 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/32c1d65f56af1b6c150497a4f9d322a50c2a9f05
commit 32c1d65f56af1b6c150497a4f9d322a50c2a9f05
Author: Osvaldo Janeri Filho <janeri@gmail.com>
Date: Fri Oct 30 08:41:19 2026 -0300
Prevent unsigned integer overflow in IAKERB
In iakerb_save_token(), check that token->length (size_t) won't
overflow the accumulated conversation length ctx->conv.length
(unsigned int).
[ghudson@mit.edu: edited commit message]
ticket: 9278 (new)
tags: pullup
target_version: 1.22-next
src/lib/gssapi/krb5/iakerb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
index 7cc4710e2..5f5a41a1e 100644
--- a/src/lib/gssapi/krb5/iakerb.c
+++ b/src/lib/gssapi/krb5/iakerb.c
@@ -188,6 +188,9 @@ iakerb_save_token(iakerb_ctx_id_t ctx, const gss_buffer_t token)
{
char *p;
+ if (token->length > UINT_MAX - ctx->conv.length)
+ return ENOMEM;
+
p = realloc(ctx->conv.data, ctx->conv.length + token->length);
if (p == NULL)
return ENOMEM;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
