[31626] in CVS-changelog-for-Kerberos-V5
krb5 commit: Prevent buffer overrun in old leashdll functions
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 11:57:04 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109165658.6DEFA105814@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 11:56:58 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/3e5cb96070fbd83f09098a14e220efc85056c572
commit 3e5cb96070fbd83f09098a14e220efc85056c572
Author: Greg Hudson <ghudson@mit.edu>
Date: Wed Sep 2 15:54:33 2026 -0400
Prevent buffer overrun in old leashdll functions
Leash_kinit_dlg() and Leash_changepwd_dlg() use a dialog callback
function PasswordProc(). If the caller supplies a principal name
longer than 254 bytes via lpdlginfo->principal, PasswordProc() writes
beyond the bounds of a stack-allocated array. Reported by Rahul
Hoysala.
These functions are both deprecated in favor of _ex variants (which
use a different dialog callback) and are not used by Leash.
ticket: 9233 (new)
tags: pullup
target_version: 1.22-next
src/windows/leashdll/lsh_pwd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/windows/leashdll/lsh_pwd.c b/src/windows/leashdll/lsh_pwd.c
index f94481109..f06bd73d8 100644
--- a/src/windows/leashdll/lsh_pwd.c
+++ b/src/windows/leashdll/lsh_pwd.c
@@ -550,7 +550,7 @@ PasswordProc(
SetProp(hDialog, "HANDLES_HELP", (HANDLE)1);
- if (lpdi->principal)
+ if (lpdi->principal && lstrlen(lpdi->principal) < sizeof(principal))
lstrcpy(principal, lpdi->principal);
else
{
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
