From 9d4f698523bc4fcbfe000d20876ad8c51702c4c8 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 27 Apr 2021 11:12:23 +0200 Subject: ntlm: precation against super huge type2 offsets ... which otherwise caused an integer overflow and circumvented the if() conditional size check. Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=33720 Assisted-by: Max Dymond --- lib/vauth/ntlm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'lib/vauth/ntlm.c') diff --git a/lib/vauth/ntlm.c b/lib/vauth/ntlm.c index 7f5e0b174..47e53572c 100644 --- a/lib/vauth/ntlm.c +++ b/lib/vauth/ntlm.c @@ -178,7 +178,8 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data, target_info_len = Curl_read16_le(&type2[40]); target_info_offset = Curl_read32_le(&type2[44]); if(target_info_len > 0) { - if((target_info_offset + target_info_len) > type2len || + if((target_info_offset > type2len) || + (target_info_offset + target_info_len) > type2len || target_info_offset < 48) { infof(data, "NTLM handshake failure (bad type-2 message). " "Target Info Offset Len is set incorrect by the peer\n"); -- cgit v1.2.1