krb5 commit [krb5-1.17]: Fix input length checking in SPNEGO DER decoding

[Greg Hudson]

https://github.com/krb5/krb5/commit/9e65436cb03d6f0ec93c6fdef68af8ed6077e997
commit 9e65436cb03d6f0ec93c6fdef68af8ed6077e997
Author: Greg Hudson <ghudson at mit.edu>
Date:   Tue Jul 28 12:58:26 2020 -0400

    Fix input length checking in SPNEGO DER decoding
    
    In get_mech_set(), check the length before reading the first byte, and
    decrease the length by the tag byte when reading and verifying the
    sequence length.
    
    In get_req_flags(), check the length before reading the first byte,
    and check the context tag length after decoding it.
    
    (cherry picked from commit 64f4b75a22212681ca293f8f09ddd24b0244d5b4)
    
    ticket: 8933
    version_fixed: 1.17.2

 src/lib/gssapi/spnego/spnego_mech.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index 24c94a7..d409245 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -3381,14 +3381,14 @@ get_mech_set(OM_uint32 *minor_status, unsigned char **buff_in,
 	unsigned char		*start;
 	int i;
 
-	if (**buff_in != SEQUENCE_OF)
+	if (buff_length < 1 || **buff_in != SEQUENCE_OF)
 		return (NULL);
 
 	start = *buff_in;
 	(*buff_in)++;
 
-	length = gssint_get_der_length(buff_in, buff_length, &bytes);
-	if (length < 0 || buff_length - bytes < (unsigned int)length)
+	length = gssint_get_der_length(buff_in, buff_length - 1, &bytes);
+	if (length < 0 || buff_length - 1 - bytes < (unsigned int)length)
 		return NULL;
 
 	major_status = gss_create_empty_oid_set(minor_status,
@@ -3468,11 +3468,11 @@ get_req_flags(unsigned char **buff_in, OM_uint32 bodysize,
 {
 	unsigned int len;
 
-	if (**buff_in != (CONTEXT | 0x01))
+	if (bodysize < 1 || **buff_in != (CONTEXT | 0x01))
 		return (0);
 
 	if (g_get_tag_and_length(buff_in, (CONTEXT | 0x01),
-				bodysize, &len) < 0)
+				 bodysize, &len) < 0 || len != 4)
 		return GSS_S_DEFECTIVE_TOKEN;
 
 	if (*(*buff_in)++ != BIT_STRING)