diff options
| author | assar <assar@FreeBSD.org> | 2002-10-23 06:10:08 +0000 |
|---|---|---|
| committer | assar <assar@FreeBSD.org> | 2002-10-23 06:10:08 +0000 |
| commit | 36fdd564c795ca828c52e635912f88ea65f23dc3 (patch) | |
| tree | b1a3f32735bb6e5306fed5217baf439a9860054d /crypto | |
| parent | 7eac497678eb0fa9386bd4c5a3355299a1fffcf2 (diff) | |
| parent | 1b79516e3fa76f1fa2be33d40cb42fcfc507596a (diff) | |
| download | FreeBSD-src-36fdd564c795ca828c52e635912f88ea65f23dc3.zip FreeBSD-src-36fdd564c795ca828c52e635912f88ea65f23dc3.tar.gz | |
This commit was generated by cvs2svn to compensate for changes in r105765,
which included commits to RCS files with non-trunk default branches.
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/kerberosIV/kadmin/kadm_ser_wrap.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/crypto/kerberosIV/kadmin/kadm_ser_wrap.c b/crypto/kerberosIV/kadmin/kadm_ser_wrap.c index 196a89c..29f142c 100644 --- a/crypto/kerberosIV/kadmin/kadm_ser_wrap.c +++ b/crypto/kerberosIV/kadmin/kadm_ser_wrap.c @@ -117,16 +117,25 @@ kadm_ser_in(u_char **dat, int *dat_len, u_char *errdat) u_char *retdat, *tmpdat; int retval, retlen; - if (strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE)) { + if (*dat_len < (KADM_VERSIZE + sizeof(u_int32_t)) + || strncmp(KADM_VERSTR, (char *)*dat, KADM_VERSIZE) != 0) { errpkt(errdat, dat, dat_len, KADM_BAD_VER); return KADM_BAD_VER; } in_len = KADM_VERSIZE; /* get the length */ - if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0) + if ((retc = stv_long(*dat, &r_len, in_len, *dat_len)) < 0 || + (r_len > *dat_len - KADM_VERSIZE - sizeof(u_int32_t))) { + errpkt(errdat, dat, dat_len, KADM_LENGTH_ERROR); return KADM_LENGTH_ERROR; + } + in_len += retc; authent.length = *dat_len - r_len - KADM_VERSIZE - sizeof(u_int32_t); + if (authent.length > MAX_KTXT_LEN) { + errpkt(errdat, dat, dat_len, KADM_LENGTH_ERROR); + return KADM_LENGTH_ERROR; + } memcpy(authent.dat, (char *)(*dat) + in_len, authent.length); authent.mbz = 0; /* service key should be set before here */ |
