svn rev #23636: branches/krb5-1-7/src/lib/gssapi/krb5/

[tlyu@MIT.EDU]

http://src.mit.edu/fisheye/changelog/krb5/?cs=23636
Commit By: tlyu
Log Message:
ticket: 6559
version_fixed: 1.7.1
status: resolved

pull up r22732 from trunk

 ------------------------------------------------------------------------
 r22732 | ghudson | 2009-09-11 13:30:51 -0400 (Fri, 11 Sep 2009) | 7 lines

 ticket: 6559
 subject: Fix parsing of GSS exported names
 tags: pullup
 target_version: 1.7.1

 Cherry-picked from Luke's authdata branch.


Changed Files:
U   branches/krb5-1-7/src/lib/gssapi/krb5/import_name.c
Modified: branches/krb5-1-7/src/lib/gssapi/krb5/import_name.c
===================================================================
--- branches/krb5-1-7/src/lib/gssapi/krb5/import_name.c	2010-01-12 02:50:09 UTC (rev 23635)
+++ branches/krb5-1-7/src/lib/gssapi/krb5/import_name.c	2010-01-12 02:50:15 UTC (rev 23636)
@@ -56,7 +56,8 @@
     krb5_context context;
     krb5_principal princ;
     krb5_error_code code;
-    char *stringrep, *tmp, *tmp2, *cp;
+    unsigned char *cp, *end;
+    char *stringrep, *tmp, *tmp2;
     OM_uint32    length;
 #ifndef NO_PASSWORD
     struct passwd *pw;
@@ -155,7 +156,12 @@
             goto do_getpwuid;
 #endif
         } else if (g_OID_equal(input_name_type, gss_nt_exported_name)) {
-            cp = tmp;
+#define BOUNDS_CHECK(cp, end, n) do { if ((end) - (cp) < (n)) \
+                    goto fail_name; } while (0)
+            cp = (unsigned char *)tmp;
+            end = cp + input_name_buffer->length;
+
+            BOUNDS_CHECK(cp, end, 4);
             if (*cp++ != 0x04)
                 goto fail_name;
             if (*cp++ != 0x01)
@@ -163,20 +169,28 @@
             if (*cp++ != 0x00)
                 goto fail_name;
             length = *cp++;
-            if (length != gss_mech_krb5->length+2)
+            if (length != (ssize_t)gss_mech_krb5->length+2)
                 goto fail_name;
+
+            BOUNDS_CHECK(cp, end, 2);
             if (*cp++ != 0x06)
                 goto fail_name;
             length = *cp++;
             if (length != gss_mech_krb5->length)
                 goto fail_name;
+
+            BOUNDS_CHECK(cp, end, length);
             if (memcmp(cp, gss_mech_krb5->elements, length) != 0)
                 goto fail_name;
             cp += length;
+
+            BOUNDS_CHECK(cp, end, 4);
             length = *cp++;
             length = (length << 8) | *cp++;
             length = (length << 8) | *cp++;
             length = (length << 8) | *cp++;
+
+            BOUNDS_CHECK(cp, end, length);
             tmp2 = malloc(length+1);
             if (tmp2 == NULL) {
                 xfree(tmp);
@@ -184,7 +198,7 @@
                 krb5_free_context(context);
                 return GSS_S_FAILURE;
             }
-            strncpy(tmp2, cp, length);
+            strncpy(tmp2, (char *)cp, length);
             tmp2[length] = 0;
 
             stringrep = tmp2;