diff options
| author | Greg Hudson <ghudson@mit.edu> | 2023-03-26 01:32:57 -0400 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2023-03-26 01:32:57 -0400 |
| commit | 654f257b8843e3d85e368d8816511d99a8bab987 (patch) | |
| tree | ff3d807c14474d8ee148450d872db73741f6c442 | |
| parent | bb11cc25e43a0bb39eb4d4b6b39c89e4d662342a (diff) | |
| download | krb5-654f257b8843e3d85e368d8816511d99a8bab987.tar.gz | |
Fix potential memory leak in recent commit
In get_negTokenInit(), reject a zero-length mechTypes field before
copying it into *der_mechSet, to prevent allocating a zero-length GSS
buffer.
| -rw-r--r-- | src/lib/gssapi/spnego/spnego_mech.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index bdd75868a..5923c880b 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3437,8 +3437,9 @@ get_negTokenInit(OM_uint32 *minor_status, if (!k5_der_get_value(&seq, SEQUENCE, &seq)) return GSS_S_DEFECTIVE_TOKEN; - /* Get the contents of the mechTypes field. */ - if (!k5_der_get_value(&seq, CONTEXT, &field)) + /* Get the contents of the mechTypes field. Reject an empty field here + * since we musn't allocate a zero-length buffer in the next step. */ + if (!k5_der_get_value(&seq, CONTEXT, &field) || field.len == 0) return GSS_S_DEFECTIVE_TOKEN; /* Store a copy of the contents for MIC computation. */ |