[11986] in Kerberos-V5-bugs
[krbdev.mit.edu #6907] setpw response parsing fails for lengths above
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Thu May 5 13:28:07 2011
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Greg Hudson via RT" <rt-comment@krbdev.MIT.EDU>
In-Reply-To: <rt-6907@krbdev.mit.edu>
Message-ID: <rt-6907-34033.15.0253163572328@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #6907'":;"'AdminCc of krbdev.mit.edu Ticket #6907'":;@MIT.EDU
Date: Thu, 5 May 2011 13:28:04 -0400 (EDT)
Reply-To: rt-comment@krbdev.MIT.EDU
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Index: lib/krb5/krb/chpw.c
===================================================================
--- lib/krb5/krb/chpw.c (revision 24707)
+++ lib/krb5/krb/chpw.c (working copy)
@@ -379,7 +379,7 @@
** validate the message length -
** length is big endian
*/
- message_length = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+ message_length = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
ptr += 2;
/*
** make sure the message length and packet length agree -
@@ -389,7 +389,7 @@
/*
** get the version number -
*/
- version_number = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+ version_number = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
ptr += 2;
/*
** make sure we support the version returned -
@@ -405,7 +405,7 @@
/*
** get the reply length -
*/
- ap_rep.length = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+ ap_rep.length = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
ptr += 2;
/*
** validate ap_rep length agrees with the packet length -
@@ -468,7 +468,7 @@
*/
ptr = clearresult.data;
- *result_code = (((ptr[0] << 8)&0xff) | (ptr[1]&0xff));
+ *result_code = (((ptr[0]&0xff) << 8) | (ptr[1]&0xff));
ptr += 2;
/*
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
