[krbdev.mit.edu #6447] SVN Commit

[Tom Yu via RT]

pull up rxxxx from trunk

asn1buf_imbed() can perform pointer arithmetic that causes the "bound"
pointer of the subbuffer to be less than the "next" pointer.  This can
lead to malloc() failure or crash.

In asn1buf_imbed(), check the length before doing arithmetic to set
subbuf->bound.  In asn1buf_remove_octetstring() and
asn1buf_remove_charstring(), check for invalid buffer pointers before
executing an unsigned length check against a (casted to size_t)
negative number.

http://src.mit.edu/fisheye/changelog/krb5/?cs=22180
Commit By: tlyu
Revision: 22180
Changed Files:
U   branches/krb5-1-6/src/lib/krb5/asn.1/asn1buf.c