svn rev #22175: trunk/src/lib/krb5/asn.1/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=22175
Commit By: tlyu
Log Message:
ticket: 6444
subject: CVE-2009-0847 asn1buf_imbed incorrect length validation
tags: pullup
target_version: 1.7

asn1buf_imbed() can perform pointer arithmetic that causes the "bound"
pointer of the subbuffer to be less than the "next" pointer.  This can
lead to malloc() failure or crash.

In asn1buf_imbed(), check the length before doing arithmetic to set
subbuf->bound.  In asn1buf_remove_octetstring() and
asn1buf_remove_charstring(), check for invalid buffer pointers before
executing an unsigned length check against a (casted to size_t)
negative number.


Changed Files:
U   trunk/src/lib/krb5/asn.1/asn1buf.c
Modified: trunk/src/lib/krb5/asn.1/asn1buf.c
===================================================================
--- trunk/src/lib/krb5/asn.1/asn1buf.c	2009-04-07 21:22:17 UTC (rev 22174)
+++ trunk/src/lib/krb5/asn.1/asn1buf.c	2009-04-07 21:22:20 UTC (rev 22175)
@@ -92,11 +92,11 @@
 
 asn1_error_code asn1buf_imbed(asn1buf *subbuf, const asn1buf *buf, const unsigned int length, const int indef)
 {
+    if (buf->next > buf->bound + 1) return ASN1_OVERRUN;
     subbuf->base = subbuf->next = buf->next;
     if (!indef) {
+        if (length > (size_t)(buf->bound + 1 - buf->next)) return ASN1_OVERRUN;
         subbuf->bound = subbuf->base + length - 1;
-        if (subbuf->bound > buf->bound)
-            return ASN1_OVERRUN;
     } else /* constructed indefinite */
         subbuf->bound = buf->bound;
     return 0;
@@ -205,6 +205,7 @@
 {
     unsigned int i;
 
+    if (buf->next > buf->bound + 1) return ASN1_OVERRUN;
     if (len > (size_t)(buf->bound + 1 - buf->next)) return ASN1_OVERRUN;
     if (len == 0) {
         *s = 0;
@@ -223,6 +224,7 @@
 {
     unsigned int i;
 
+    if (buf->next > buf->bound + 1) return ASN1_OVERRUN;
     if (len > (size_t)(buf->bound + 1 - buf->next)) return ASN1_OVERRUN;
     if (len == 0) {
         *s = 0;