diff options
| author | Assar Westerlund <assar@FreeBSD.org> | 2002-10-23 13:21:32 +0000 |
|---|---|---|
| committer | Assar Westerlund <assar@FreeBSD.org> | 2002-10-23 13:21:32 +0000 |
| commit | fdca47485c95e826bec23f5ba75a4da29d4fbd6e (patch) | |
| tree | 41fbac5ceec23c615a22bad26b0066b1ba89d3bc | |
| parent | 83e139de2ad578cf391e18f558223c3ee89ab46b (diff) | |
| download | src-fdca47485c95e826bec23f5ba75a4da29d4fbd6e.tar.gz src-fdca47485c95e826bec23f5ba75a4da29d4fbd6e.zip | |
MFC kadm_ser_wrap.c:1.1.1.4: fix buffer overflow
MFC updating kerberosIV and kerberos5 versions consistenly
Approved by: security-officer
Obtained from: kth-krb CVS
Notes
Notes:
svn path=/releng/4.5/; revision=105794
| -rw-r--r-- | crypto/kerberosIV/kadmin/kadm_ser_wrap.c | 13 | ||||
| -rw-r--r-- | kerberos5/include/version.h | 8 | ||||
| -rw-r--r-- | kerberosIV/include/version.h | 8 |
3 files changed, 19 insertions, 10 deletions
diff --git a/crypto/kerberosIV/kadmin/kadm_ser_wrap.c b/crypto/kerberosIV/kadmin/kadm_ser_wrap.c index 196a89c8fe11..29f142c63661 100644 --- a/crypto/kerberosIV/kadmin/kadm_ser_wrap.c +++ b/crypto/kerberosIV/kadmin/kadm_ser_wrap.c @@ -117,16 +117,25 @@ kadm_ser_in(u_char **dat, int *dat_len, u_char *errdat) u_char *retdat, *tmpdat; int retval, retlen; - if (strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE)) { + if (*dat_len < (KADM_VERSIZE + sizeof(u_int32_t)) + || strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE) != 0) { errpkt(errdat, dat, dat_len, KADM_BAD_VER); return KADM_BAD_VER; } in_len = KADM_VERSIZE; /* get the length */ - if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0) + if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0 || + (r_len > *dat_len - KADM_VERSIZE - sizeof(u_int32_t))) { + errpkt(errdat, dat, dat_len, KADM_LENGTH_ERROR); return KADM_LENGTH_ERROR; + } + in_len += retc; authent.length = *dat_len - r_len - KADM_VERSIZE - sizeof(u_int32_t); + if (authent.length > MAX_KTXT_LEN) { + errpkt(errdat, dat, dat_len, KADM_LENGTH_ERROR); + return KADM_LENGTH_ERROR; + } memcpy(authent.dat, (char *)(*dat) + in_len, authent.length); authent.mbz = 0; /* service key should be set before here */ diff --git a/kerberos5/include/version.h b/kerberos5/include/version.h index 26fc6c845f94..f8d852538ee4 100644 --- a/kerberos5/include/version.h +++ b/kerberos5/include/version.h @@ -1,5 +1,5 @@ /* $FreeBSD$ */ -char *krb4_long_version = "@(#)$Version: krb4-1.0.5 (FreeBSD) $"; -char *krb4_version = "krb4-1.0.5"; -const char *heimdal_long_version = "@(#)$Version: heimdal-0.3e (FreeBSD) $"; -const char *heimdal_version = "heimdal-0.3e"; +char *krb4_long_version = "@(#)$Version: krb4-1.0.5fb1 (FreeBSD) $"; +char *krb4_version = "krb4-1.0.5fb1"; +const char *heimdal_long_version = "@(#)$Version: Heimdal 0.3e fb1 (FreeBSD) $"; +const char *heimdal_version = "Heimdal 0.3e fb1"; diff --git a/kerberosIV/include/version.h b/kerberosIV/include/version.h index b204605c6663..069a8300c1a2 100644 --- a/kerberosIV/include/version.h +++ b/kerberosIV/include/version.h @@ -1,5 +1,5 @@ /* $FreeBSD$ */ -char *krb4_long_version = "@(#)$Version: krb4-1.0 by root on greenpeace.grondar.za (i386-unknown-freebsd4.0) Sat Jan 8 19:34:57 SAST 2000 $"; -char *krb4_version = "krb4-1.0"; -char *heimdal_long_version = "@(#)$Version: heimdal-0.1l by root on greenpeace.grondar.za (i386-unknown-freebsd4.0) Sat Jan 8 20:56:02 SAST 2000 $"; -char *heimdal_version = "heimdal-0.1l"; +char *krb4_long_version = "@(#)$Version: krb4-1.0.5fb1 (FreeBSD) $"; +char *krb4_version = "krb4-1.0.5fb1"; +char *heimdal_long_version = "@(#)$Version: Heimdal 0.3e fb1 (FreeBSD) $"; +char *heimdal_version = "Heimdal 0.3e fb1"; |