diff options
| author | Tom Yu <tlyu@mit.edu> | 2004-08-31 19:44:39 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2004-08-31 19:44:39 +0000 |
| commit | 9c656f6e2decd94106283fefc395a45823b64c28 (patch) | |
| tree | 7493dfefff92ca53354b94f3641cf2a152606e94 | |
| parent | 506af830ee337bf815ae06cc76de5f85ddca168f (diff) | |
| download | krb5-1.2.2.tar.gz | |
pullup to 1.2.x from trunkkrb5-1.2.2
ticket: 2687
git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-2-2-branch@16707 dc483132-0cff-0310-8789-dd5450dbe970
| -rw-r--r-- | src/lib/krb5/asn.1/ChangeLog | 2 | ||||
| -rw-r--r-- | src/lib/krb5/asn.1/asn1buf.c | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/src/lib/krb5/asn.1/ChangeLog b/src/lib/krb5/asn.1/ChangeLog index cbead8c2f..38513cc54 100644 --- a/src/lib/krb5/asn.1/ChangeLog +++ b/src/lib/krb5/asn.1/ChangeLog @@ -1,5 +1,7 @@ 2004-08-31 Tom Yu <tlyu@mit.edu> + * asn1buf.c: Fix denial-of-service bug. + * asn1buf.c: * krb5_decode.c: Fix double-free vulnerabilities. diff --git a/src/lib/krb5/asn.1/asn1buf.c b/src/lib/krb5/asn.1/asn1buf.c index d57cf0fd7..bcaac68e5 100644 --- a/src/lib/krb5/asn.1/asn1buf.c +++ b/src/lib/krb5/asn.1/asn1buf.c @@ -140,6 +140,8 @@ asn1_error_code asn1buf_skiptail(buf, length, indef) return ASN1_OVERRUN; } while (nestlevel > 0) { + if (buf->bound - buf->next + 1 <= 0) + return ASN1_OVERRUN; retval = asn1_get_tag_indef(buf, &class, &construction, &tagnum, &taglen, &tagindef); if (retval) return retval; |