diff options
| author | Daniel Stenberg <daniel@haxx.se> | 2019-01-02 20:33:08 +0100 |
|---|---|---|
| committer | Daniel Stenberg <daniel@haxx.se> | 2019-02-04 08:22:31 +0100 |
| commit | b780b30d1377adb10bbe774835f49e9b237fb9bb (patch) | |
| tree | 519e71d1d61ea595e807cc1f4ff283ca15405a5d | |
| parent | a730432e59754df97c8985eb3094ca1cdd3e4955 (diff) | |
| download | curl-b780b30d1377adb10bbe774835f49e9b237fb9bb.tar.gz | |
NTLM: fix size check condition for type2 received data
Bug: https://curl.haxx.se/docs/CVE-2018-16890.html
Reported-by: Wenxiang Qian
CVE-2018-16890
| -rw-r--r-- | lib/vauth/ntlm.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/lib/vauth/ntlm.c b/lib/vauth/ntlm.c index c3d55ed25..0ad4d972e 100644 --- a/lib/vauth/ntlm.c +++ b/lib/vauth/ntlm.c @@ -5,7 +5,7 @@ * | (__| |_| | _ <| |___ * \___|\___/|_| \_\_____| * - * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al. + * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al. * * This software is licensed as described in the file COPYING, which * you should have received as part of this distribution. The terms @@ -182,10 +182,11 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data, target_info_len = Curl_read16_le(&buffer[40]); target_info_offset = Curl_read32_le(&buffer[44]); if(target_info_len > 0) { - if(((target_info_offset + target_info_len) > size) || + if((target_info_offset >= size) || + ((target_info_offset + target_info_len) > size) || (target_info_offset < 48)) { infof(data, "NTLM handshake failure (bad type-2 message). " - "Target Info Offset Len is set incorrect by the peer\n"); + "Target Info Offset Len is set incorrect by the peer\n"); return CURLE_BAD_CONTENT_ENCODING; } |