[31650] in CVS-changelog-for-Kerberos-V5
krb5 commit: Check type of otherName value in PKINIT SAN code
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 11:59:40 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109165934.7C002105814@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 11:59:34 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/f59a89c297045376f2a2f758d32e010d8d7b497c
commit f59a89c297045376f2a2f758d32e010d8d7b497c
Author: Greg Hudson <ghudson@mit.edu>
Date: Fri Sep 18 19:30:43 2026 -0400
Check type of otherName value in PKINIT SAN code
In crypto_retrieve_X509_sans(), when we process a general name of type
AnotherName, check the ASN.1 type of the value before retrieving the
sequence or string pointer and length. Otherwise the function may
dereference a null or invalid pointer and crash. Discovered by
Alexandru-Ionut Jipa using Claude.
ticket: 9239 (new)
tags: pullup
target_version: 1.22-next
src/plugins/preauth/pkinit/pkinit_crypto_openssl.c | 24 ++++++++++++++++------
1 file changed, 18 insertions(+), 6 deletions(-)
diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index ba40abc4b..033e4715a 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -2011,6 +2011,8 @@ crypto_retrieve_X509_sans(krb5_context context,
const X509_EXTENSION *ext = NULL;
GENERAL_NAMES *ialt = NULL;
GENERAL_NAME *gen = NULL;
+ const ASN1_OBJECT *otype;
+ const ASN1_TYPE *ovalue;
if (princs_ret != NULL)
*princs_ret = NULL;
@@ -2071,10 +2073,15 @@ crypto_retrieve_X509_sans(krb5_context context,
gen = sk_GENERAL_NAME_value(ialt, i);
switch (gen->type) {
case GEN_OTHERNAME:
- name = asn1string_to_data(gen->d.otherName->value->value.sequence);
- if (princs != NULL &&
- OBJ_cmp(plgctx->id_pkinit_san,
- gen->d.otherName->type_id) == 0) {
+ otype = gen->d.otherName->type_id;
+ ovalue = gen->d.otherName->value;
+ if (princs != NULL && OBJ_cmp(plgctx->id_pkinit_san, otype) == 0) {
+ if (ovalue->type != V_ASN1_SEQUENCE) {
+ pkiDebug("%s: id-pkinit-san name is not a sequence\n",
+ __FUNCTION__);
+ continue;
+ }
+ name = asn1string_to_data(ovalue->value.sequence);
#ifdef DEBUG_ASN1
print_buffer_bin((unsigned char *)name.data, name.length,
"/tmp/pkinit_san");
@@ -2086,8 +2093,13 @@ crypto_retrieve_X509_sans(krb5_context context,
p++;
}
} else if (upns != NULL &&
- OBJ_cmp(plgctx->id_ms_san_upn,
- gen->d.otherName->type_id) == 0) {
+ OBJ_cmp(plgctx->id_ms_san_upn, otype) == 0) {
+ if (ovalue->type != V_ASN1_UTF8STRING) {
+ pkiDebug("%s: id-ms-san-upn name is not a UTF-8 string\n",
+ __FUNCTION__);
+ continue;
+ }
+ name = asn1string_to_data(ovalue->value.utf8string);
/* Prevent abuse of embedded null characters. */
if (memchr(name.data, '\0', name.length))
break;
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
