[17144] in Kerberos-V5-bugs
[krbdev.mit.edu #9249] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Fri Oct 30 13:02:44 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-1756957-1793343086-1877.9249-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9249":;
Date: Fri, 30 Oct 2026 02:51:26 -0400
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Fri Oct 30 02:51:26 2026: Request 9249 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9249 >
Improve libdb2 data validation
In the btree module, make __bt_pgin() bounds-check h->lower and reset
the page to empty if it is not within the allowable range. Change the
definition of NEXTINDEX to clamp the result lower bound to 0, so that
it can't return an enormous offset due to unsigned underflow. In
__bt_search() and __bt_seqset(), detect when we fill the parent page
stack (because the database is circular or the tree is unexpectedly
imbalanced) and return an error.
In the hash module, make __kdb2_hash_open() reject a block size of
zero to prevent division by zero, and reject an invalid overflow
pointer to prevent an out-of-bounds memory access. Prevent unbounded
recursion in collect_key() and collect_data() by adding a depth
counter and limiting it to max_bucket. Prevent out-of-bounds access
in __pgin_routine() by bounds-checking num_ent for non-bitmap pages.
[ghudson@mit.edu: combined several commits and rewrote commit message;
simplified __bt_pgin() bounds check and made it leave h->lower == 0
alone for nroot(); added checks for full parent page stack; made minor
edits for code style]
https://github.com/krb5/krb5/commit/64470b21a544f1619673373c74efd96c99778028
Author: Bogdan Boguslavskij <bogdanb@altlinux.org>
Committer: Greg Hudson <ghudson@mit.edu>
Commit: 64470b21a544f1619673373c74efd96c99778028
Branch: master
src/plugins/kdb/db2/libdb2/btree/bt_conv.c | 10 +++++++++-
src/plugins/kdb/db2/libdb2/btree/bt_search.c | 2 ++
src/plugins/kdb/db2/libdb2/btree/bt_seq.c | 8 ++++++++
src/plugins/kdb/db2/libdb2/btree/btree.h | 8 ++++++--
src/plugins/kdb/db2/libdb2/hash/hash.c | 8 +++++++-
src/plugins/kdb/db2/libdb2/hash/hash_bigkey.c | 23 ++++++++++++++---------
src/plugins/kdb/db2/libdb2/hash/hash_page.c | 13 +++++++++++++
7 files changed, 59 insertions(+), 13 deletions(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
