diff options
| author | Greg Hudson <ghudson@mit.edu> | 2012-12-10 14:18:30 -0500 |
|---|---|---|
| committer | Greg Hudson <ghudson@mit.edu> | 2012-12-10 14:21:36 -0500 |
| commit | d3c5450ddf0b20855e86dab41735d56c6860156b (patch) | |
| tree | 1013b3c871ce2b5e72c925387115bdbb98853532 /src/lib | |
| parent | db26cd1b6f422c20c062385e0daeb8c95137428d (diff) | |
| download | krb5-d3c5450ddf0b20855e86dab41735d56c6860156b.tar.gz krb5-d3c5450ddf0b20855e86dab41735d56c6860156b.tar.xz krb5-d3c5450ddf0b20855e86dab41735d56c6860156b.zip | |
Fix various integer issues
In kdc_util.c and spnego_mech.c, error returns from ASN.1 length
functions could be ignored because they were assigned to unsigned
values. In spnego_mech.c, two buffer size checks could be rewritten
to reduce the likelihood of pointer overflow. In dump.c and
kdc_preauth.c, calloc() could be used to simplify the code and avoid
multiplication overflow. In pkinit_clnt.c, the wrong value was
checked for a null result from malloc(), and the code could be
simplified.
Reported by Nickolai Zeldovich <nickolai@csail.mit.edu>.
ticket: 7488
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/gssapi/spnego/spnego_mech.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index 812c16df6..696f42df5 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3998,7 +3998,7 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size) { unsigned char *buf = *buf_in; unsigned char *endptr = buf + cur_size; - unsigned int seqsize; + int seqsize; int ret = 0; unsigned int bytes; @@ -4022,7 +4022,7 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size) /* * Make sure we have the entire buffer as described */ - if (buf + seqsize > endptr) + if (seqsize > endptr - buf) return (G_BAD_TOK_HEADER); } else { return (G_BAD_TOK_HEADER); @@ -4039,7 +4039,7 @@ g_verify_neg_token_init(unsigned char **buf_in, unsigned int cur_size) /* * Make sure we have the entire buffer as described */ - if (buf + bytes > endptr) + if (seqsize > endptr - buf) return (G_BAD_TOK_HEADER); } else { return (G_BAD_TOK_HEADER); |