diff options
| author | Joseph Sutton <josephsutton@catalyst.net.nz> | 2022-10-12 13:57:33 +1300 |
|---|---|---|
| committer | Jule Anger <janger@samba.org> | 2022-10-24 07:57:56 +0200 |
| commit | 3007e32072f5b34b4ca403b9d52100627c3a74d2 (patch) | |
| tree | 53eacc5934f299f58c2a1b9162627bb47a449c51 /third_party | |
| parent | f33f8a515b0f44db58ebeb7274a3118277143a4f (diff) | |
| download | samba-3007e32072f5b34b4ca403b9d52100627c3a74d2.tar.gz | |
CVE-2022-3437 third_party/heimdal: Pass correct length to _gssapi_verify_pad()
We later subtract 8 when calculating the length of the output message
buffer. If padlength is excessively high, this calculation can underflow
and result in a very large positive value.
Now we properly constrain the value of padlength so underflow shouldn't
be possible.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15134
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'third_party')
| -rw-r--r-- | third_party/heimdal/lib/gssapi/krb5/unwrap.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/third_party/heimdal/lib/gssapi/krb5/unwrap.c b/third_party/heimdal/lib/gssapi/krb5/unwrap.c index 493165bcfab..64613698fa4 100644 --- a/third_party/heimdal/lib/gssapi/krb5/unwrap.c +++ b/third_party/heimdal/lib/gssapi/krb5/unwrap.c @@ -124,7 +124,7 @@ unwrap_des } else { /* check pad */ ret = _gssapi_verify_pad(input_message_buffer, - input_message_buffer->length - len, + input_message_buffer->length - len - 8, &padlength); if (ret) return ret; @@ -292,7 +292,7 @@ unwrap_des3 } else { /* check pad */ ret = _gssapi_verify_pad(input_message_buffer, - input_message_buffer->length - len, + input_message_buffer->length - len - 8, &padlength); if (ret) return ret; |