[31645] in CVS-changelog-for-Kerberos-V5
krb5 commit: Remove unsafe principal parsing from Leashdll
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 11:59:15 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109165907.88029105814@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 11:59:07 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/54b7bbe13dd1d4d2646c4fbcc8d68925603924fb
commit 54b7bbe13dd1d4d2646c4fbcc8d68925603924fb
Author: Greg Hudson <ghudson@mit.edu>
Date: Sat Sep 19 21:30:00 2026 -0400
Remove unsafe principal parsing from Leashdll
In Leash_int_kinit_ex(), remove the code to parse and reassemble the
principal name; it has no length checks and could overflow
stack-allocated buffers if a long principal name is supplied. This
parsing code was used to perform krb4 fallbacks if getting tickets via
krb5 failed, and is no longer useful.
Discovered by Aisle Research.
ticket: 9241 (new)
tags: pullup
target_version: 1.22-next
src/windows/leashdll/lshfunc.c | 82 ++++--------------------------------------
1 file changed, 7 insertions(+), 75 deletions(-)
diff --git a/src/windows/leashdll/lshfunc.c b/src/windows/leashdll/lshfunc.c
index 14cb361db..c6904fcca 100644
--- a/src/windows/leashdll/lshfunc.c
+++ b/src/windows/leashdll/lshfunc.c
@@ -457,19 +457,8 @@ Leash_int_kinit_ex(
int displayErrors
)
{
- char aname[ANAME_SZ];
- char inst[INST_SZ];
- char realm[REALM_SZ];
- char first_part[256];
- char second_part[256];
- char temp[1024];
char* custom_msg;
- int count;
- int i;
- int rc5 = 0;
- int rcA = 0;
- int rcB = 0;
- int rcL = 0;
+ int count, i, r, rc;
if (lifetime < 5)
lifetime = 1;
@@ -487,70 +476,13 @@ Leash_int_kinit_ex(
if (lifetime > 255)
lifetime = 255;
- err_context = "parsing principal";
-
- memset(temp, '\0', sizeof(temp));
- memset(inst, '\0', sizeof(inst));
- memset(realm, '\0', sizeof(realm));
- memset(first_part, '\0', sizeof(first_part));
- memset(second_part, '\0', sizeof(second_part));
-
- sscanf(principal, "%[/0-9a-zA-Z._-]@%[/0-9a-zA-Z._-]", first_part, second_part);
- strcpy(temp, first_part);
- strcpy(realm, second_part);
- memset(first_part, '\0', sizeof(first_part));
- memset(second_part, '\0', sizeof(second_part));
- if (sscanf(temp, "%[@0-9a-zA-Z._-]/%[@0-9a-zA-Z._-]", first_part, second_part) == 2)
- {
- strcpy(aname, first_part);
- strcpy(inst, second_part);
- }
- else
- {
- count = 0;
- i = 0;
- for (i = 0; temp[i]; i++)
- {
- if (temp[i] == '.')
- ++count;
- }
- if (count > 1)
- {
- strcpy(aname, temp);
- }
- else
- {
- {
- strcpy(aname, temp);
- }
- }
- }
-
- memset(temp, '\0', sizeof(temp));
- strcpy(temp, aname);
- if (strlen(inst) != 0)
- {
- strcat(temp, "/");
- strcat(temp, inst);
- }
- if (strlen(realm) != 0)
- {
- strcat(temp, "@");
- strcat(temp, realm);
- }
-
- rc5 = Leash_krb5_kinit(ctx, hParent,
- temp, password, lifetime,
- forwardable,
- proxiable,
- renew_life,
- addressless,
- publicip
- );
- custom_msg = (rc5 == KRB5KRB_AP_ERR_BAD_INTEGRITY) ? "Password incorrect" : NULL;
+ rc = Leash_krb5_kinit(ctx, hParent, principal, password, lifetime,
+ forwardable, proxiable, renew_life, addressless,
+ publicip);
+ custom_msg = (rc == KRB5KRB_AP_ERR_BAD_INTEGRITY) ? "Password incorrect" :
+ NULL;
return leash_error_message("Ticket initialization failed.",
- rcL, rc5, rcA, custom_msg,
- displayErrors);
+ 0, rc, 0, custom_msg, displayErrors);
}
long FAR
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
