[31615] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Prevent unsigned integer overflow in IAKERB
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Tue Nov 3 19:18:31 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261104001826.4896F105851@krbdev.mit.edu>
Date: Tue, 3 Nov 2026 19:18:26 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/1386c7bfbfb36b64511311257905b07e6fe7cbe0
commit 1386c7bfbfb36b64511311257905b07e6fe7cbe0
Author: Osvaldo Janeri Filho <janeri@gmail.com>
Date: Fri Oct 30 08:41:19 2026 -0300
Prevent unsigned integer overflow in IAKERB
In iakerb_save_token(), check that token->length (size_t) won't
overflow the accumulated conversation length ctx->conv.length
(unsigned int).
[ghudson@mit.edu: edited commit message]
(cherry picked from commit 32c1d65f56af1b6c150497a4f9d322a50c2a9f05)
ticket: 9278
version_fixed: 1.22.3
src/lib/gssapi/krb5/iakerb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
index 7cc4710e2..5f5a41a1e 100644
--- a/src/lib/gssapi/krb5/iakerb.c
+++ b/src/lib/gssapi/krb5/iakerb.c
@@ -188,6 +188,9 @@ iakerb_save_token(iakerb_ctx_id_t ctx, const gss_buffer_t token)
{
char *p;
+ if (token->length > UINT_MAX - ctx->conv.length)
+ return ENOMEM;
+
p = realloc(ctx->conv.data, ctx->conv.length + token->length);
if (p == NULL)
return ENOMEM;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
