[31680] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Use safe string copies in MSLSA ccache type
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:02:33 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170228.E8426105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:02:28 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/7b3a8cb928edf9fe44dd8c2fc4f95f3cd5ccb3cb
commit 7b3a8cb928edf9fe44dd8c2fc4f95f3cd5ccb3cb
Author: Greg Hudson <ghudson@mit.edu>
Date: Mon Sep 21 23:40:02 2026 -0400
Use safe string copies in MSLSA ccache type
In UnicodeStringToMITPrinc(), KerbExternalNameToMITPrinc(), and
MSCredToMITCred(), use safe variants of wide-character string copy and
concatenation functions, to prevent buffer overflows if the LSA cache
contains unexpectedly long principal name components.
(cherry picked from commit 151be7373b97ae78d471e016f8da89e7e2cf4548)
ticket: 9244
version_fixed: 1.22.3
src/lib/krb5/ccache/cc_mslsa.c | 53 +++++++++++++++++++++++++-----------------
1 file changed, 32 insertions(+), 21 deletions(-)
diff --git a/src/lib/krb5/ccache/cc_mslsa.c b/src/lib/krb5/ccache/cc_mslsa.c
index 675cf4d11..80b00ce51 100644
--- a/src/lib/krb5/ccache/cc_mslsa.c
+++ b/src/lib/krb5/ccache/cc_mslsa.c
@@ -207,15 +207,17 @@ UnicodeStringToMITPrinc(UNICODE_STRING *service, UNICODE_STRING *realm,
char aname[512];
/* Convert the realm to a wchar string. */
- realmbuf[0] = '\0';
- wcsncpy(realmbuf, realm->Buffer, realm->Length / sizeof(WCHAR));
- realmbuf[realm->Length / sizeof(WCHAR)] = 0;
+ if (wcsncpy_s(realmbuf, sizeof(realmbuf) / sizeof(WCHAR),
+ realm->Buffer, realm->Length / sizeof(WCHAR)) != 0)
+ return FALSE;
/* Convert the principal components to a wchar string. */
- princbuf[0]=0;
- wcsncpy(princbuf, service->Buffer, service->Length/sizeof(WCHAR));
- princbuf[service->Length/sizeof(WCHAR)]=0;
- wcscat(princbuf, L"@");
- wcscat(princbuf, realmbuf);
+ if (wcsncpy_s(princbuf, sizeof(princbuf) / sizeof(WCHAR),
+ service->Buffer, service->Length / sizeof(WCHAR)) != 0)
+ return FALSE;
+ if (wcscat_s(princbuf, sizeof(princbuf) / sizeof(WCHAR), L"@") != 0)
+ return FALSE;
+ if (wcscat_s(princbuf, sizeof(princbuf) / sizeof(WCHAR), realmbuf) != 0)
+ return FALSE;
if (UnicodeToANSI(princbuf, aname, sizeof(aname))) {
if (krb5_parse_name(context, aname, principal) == 0)
return TRUE;
@@ -233,15 +235,22 @@ KerbExternalNameToMITPrinc(KERB_EXTERNAL_NAME *msprinc, WCHAR *realm, krb5_conte
USHORT i;
princbuf[0]=0;
for (i=0;i<msprinc->NameCount;i++) {
- wcsncpy(tmpbuf, msprinc->Names[i].Buffer,
- msprinc->Names[i].Length/sizeof(WCHAR));
- tmpbuf[msprinc->Names[i].Length/sizeof(WCHAR)]=0;
- if (princbuf[0])
- wcscat(princbuf, L"/");
- wcscat(princbuf, tmpbuf);
+ if (wcsncpy_s(tmpbuf, sizeof(tmpbuf) / sizeof(WCHAR),
+ msprinc->Names[i].Buffer,
+ msprinc->Names[i].Length / sizeof(WCHAR)) != 0)
+ return FALSE;
+ if (princbuf[0] != '\0') {
+ if (wcscat_s(princbuf, sizeof(princbuf) / sizeof(WCHAR),
+ L"/") != 0)
+ return FALSE;
+ }
+ if (wcscat_s(princbuf, sizeof(princbuf) / sizeof(WCHAR), tmpbuf) != 0)
+ return FALSE;
}
- wcscat(princbuf, L"@");
- wcscat(princbuf, realm);
+ if (wcscat_s(princbuf, sizeof(princbuf) / sizeof(WCHAR), L"@") != 0)
+ return FALSE;
+ if (wcscat_s(princbuf, sizeof(princbuf) / sizeof(WCHAR), realm) != 0)
+ return FALSE;
if (UnicodeToANSI(princbuf, aname, sizeof(aname))) {
if (krb5_parse_name(context, aname, principal) == 0)
return TRUE;
@@ -323,15 +332,17 @@ MSCredToMITCred(KERB_EXTERNAL_TICKET *msticket, UNICODE_STRING ClientRealm,
creds->magic=KV5M_CREDS;
// construct Client Principal
- wcsncpy(wrealm, ClientRealm.Buffer, ClientRealm.Length/sizeof(WCHAR));
- wrealm[ClientRealm.Length/sizeof(WCHAR)]=0;
+ if (wcsncpy_s(wrealm, sizeof(wrealm) / sizeof(WCHAR),
+ ClientRealm.Buffer, ClientRealm.Length / sizeof(WCHAR)) != 0)
+ return FALSE;
if (!KerbExternalNameToMITPrinc(msticket->ClientName, wrealm, context, &creds->client))
return FALSE;
// construct Service Principal
- wcsncpy(wrealm, msticket->DomainName.Buffer,
- msticket->DomainName.Length/sizeof(WCHAR));
- wrealm[msticket->DomainName.Length/sizeof(WCHAR)]=0;
+ if (wcsncpy_s(wrealm, sizeof(wrealm) / sizeof(WCHAR),
+ msticket->DomainName.Buffer,
+ msticket->DomainName.Length / sizeof(WCHAR)) != 0)
+ return FALSE;
if (!KerbExternalNameToMITPrinc(msticket->ServiceName, wrealm, context, &creds->server))
return FALSE;
MSSessionKeyToMITKeyblock(&msticket->SessionKey, context,
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
