From: Greg Hudson Date: Sun, 26 Mar 2023 05:32:57 +0000 (-0400) Subject: Fix potential memory leak in recent commit X-Git-Tag: krb5-1.21-beta1~15 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=654f257b8843e3d85e368d8816511d99a8bab987;p=thirdparty%2Fkrb5.git Fix potential memory leak in recent commit In get_negTokenInit(), reject a zero-length mechTypes field before copying it into *der_mechSet, to prevent allocating a zero-length GSS buffer. --- diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c index bdd75868ae..5923c880b8 100644 --- a/src/lib/gssapi/spnego/spnego_mech.c +++ b/src/lib/gssapi/spnego/spnego_mech.c @@ -3437,8 +3437,9 @@ get_negTokenInit(OM_uint32 *minor_status, if (!k5_der_get_value(&seq, SEQUENCE, &seq)) return GSS_S_DEFECTIVE_TOKEN; - /* Get the contents of the mechTypes field. */ - if (!k5_der_get_value(&seq, CONTEXT, &field)) + /* Get the contents of the mechTypes field. Reject an empty field here + * since we musn't allocate a zero-length buffer in the next step. */ + if (!k5_der_get_value(&seq, CONTEXT, &field) || field.len == 0) return GSS_S_DEFECTIVE_TOKEN; /* Store a copy of the contents for MIC computation. */