Check lengths in xdr_krb5_key_data()

Ensure that xdr_krb5_key_data() does not produce an inconsistent
representation if the serialized key_data_contents fields do not match
the corresponding byte array lengths.  (This function is only used by
libkadm5srv to serialize historical key data in per-principal kadmin
data.)

ticket: 9172 (new)

diff --git a/src/lib/kadm5/srv/adb_xdr.c b/src/lib/kadm5/srv/adb_xdr.c
index b6ffdb8c7a9941eb35658b4392a1bb657c7c4d21..b14cb96eed2215061034256eb31b705a719f13c5 100644 (file)
--- a/src/lib/kadm5/srv/adb_xdr.c
+++ b/src/lib/kadm5/srv/adb_xdr.c
@@ -36,11 +36,15 @@ xdr_krb5_key_data(XDR *xdrs, krb5_key_data *objp)
     if (!xdr_bytes(xdrs, (char **) &objp->key_data_contents[0],
                   &tmp, ~0))
        return FALSE;
+    if (tmp != objp->key_data_length[0])
+       return FALSE;
 
     tmp = (unsigned int) objp->key_data_length[1];
     if (!xdr_bytes(xdrs, (char **) &objp->key_data_contents[1],
                   &tmp, ~0))
        return FALSE;
+    if (tmp != objp->key_data_length[1])
+       return FALSE;
 
     /* don't need to copy tmp out, since key_data_length will be set
        by the above encoding. */