[31677] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Remove unsafe principal parsing from Leashdll
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:02:19 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170215.98565105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:02:15 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/faf817da5341b849fd53e191ef05b54151195632
commit faf817da5341b849fd53e191ef05b54151195632
Author: Greg Hudson <ghudson@mit.edu>
Date: Sat Sep 19 21:30:00 2026 -0400
Remove unsafe principal parsing from Leashdll
In Leash_int_kinit_ex(), remove the code to parse and reassemble the
principal name; it has no length checks and could overflow
stack-allocated buffers if a long principal name is supplied. This
parsing code was used to perform krb4 fallbacks if getting tickets via
krb5 failed, and is no longer useful.
Discovered by Aisle Research.
(cherry picked from commit 54b7bbe13dd1d4d2646c4fbcc8d68925603924fb)
ticket: 9241
version_fixed: 1.22.3
src/windows/leashdll/lshfunc.c | 82 ++++--------------------------------------
1 file changed, 7 insertions(+), 75 deletions(-)
diff --git a/src/windows/leashdll/lshfunc.c b/src/windows/leashdll/lshfunc.c
index 14cb361db..c6904fcca 100644
--- a/src/windows/leashdll/lshfunc.c
+++ b/src/windows/leashdll/lshfunc.c
@@ -457,19 +457,8 @@ Leash_int_kinit_ex(
int displayErrors
)
{
- char aname[ANAME_SZ];
- char inst[INST_SZ];
- char realm[REALM_SZ];
- char first_part[256];
- char second_part[256];
- char temp[1024];
char* custom_msg;
- int count;
- int i;
- int rc5 = 0;
- int rcA = 0;
- int rcB = 0;
- int rcL = 0;
+ int count, i, r, rc;
if (lifetime < 5)
lifetime = 1;
@@ -487,70 +476,13 @@ Leash_int_kinit_ex(
if (lifetime > 255)
lifetime = 255;
- err_context = "parsing principal";
-
- memset(temp, '\0', sizeof(temp));
- memset(inst, '\0', sizeof(inst));
- memset(realm, '\0', sizeof(realm));
- memset(first_part, '\0', sizeof(first_part));
- memset(second_part, '\0', sizeof(second_part));
-
- sscanf(principal, "%[/0-9a-zA-Z._-]@%[/0-9a-zA-Z._-]", first_part, second_part);
- strcpy(temp, first_part);
- strcpy(realm, second_part);
- memset(first_part, '\0', sizeof(first_part));
- memset(second_part, '\0', sizeof(second_part));
- if (sscanf(temp, "%[@0-9a-zA-Z._-]/%[@0-9a-zA-Z._-]", first_part, second_part) == 2)
- {
- strcpy(aname, first_part);
- strcpy(inst, second_part);
- }
- else
- {
- count = 0;
- i = 0;
- for (i = 0; temp[i]; i++)
- {
- if (temp[i] == '.')
- ++count;
- }
- if (count > 1)
- {
- strcpy(aname, temp);
- }
- else
- {
- {
- strcpy(aname, temp);
- }
- }
- }
-
- memset(temp, '\0', sizeof(temp));
- strcpy(temp, aname);
- if (strlen(inst) != 0)
- {
- strcat(temp, "/");
- strcat(temp, inst);
- }
- if (strlen(realm) != 0)
- {
- strcat(temp, "@");
- strcat(temp, realm);
- }
-
- rc5 = Leash_krb5_kinit(ctx, hParent,
- temp, password, lifetime,
- forwardable,
- proxiable,
- renew_life,
- addressless,
- publicip
- );
- custom_msg = (rc5 == KRB5KRB_AP_ERR_BAD_INTEGRITY) ? "Password incorrect" : NULL;
+ rc = Leash_krb5_kinit(ctx, hParent, principal, password, lifetime,
+ forwardable, proxiable, renew_life, addressless,
+ publicip);
+ custom_msg = (rc == KRB5KRB_AP_ERR_BAD_INTEGRITY) ? "Password incorrect" :
+ NULL;
return leash_error_message("Ticket initialization failed.",
- rcL, rc5, rcA, custom_msg,
- displayErrors);
+ 0, rc, 0, custom_msg, displayErrors);
}
long FAR
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
