From: Greg Hudson <ghudson@mit.edu>
Date: Wed, 6 Nov 2024 22:31:37 +0000 (-0500)
Subject: Prevent undefined shift in decode_krb5_flags()
X-Git-Tag: krb5-1.22-beta1~55
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d09433aed821d40142b10dc5b4a0aa8110c5a09e;p=thirdparty%2Fkrb5.git

Prevent undefined shift in decode_krb5_flags()

In the statement "f |= bits[i] << (8 * (3 - i))", bits[i] is
implicitly promoted from uint8_t to int according to the integer
promotion rules (C99 6.3.1.1).  If i is 0 and bits[i] >= 128, the
result cannot be represented as an int and the behavior of the shift
is undefined (C99 6.5.7).  To ensure that the shift operation is
defined, cast bits[i] to uint32_t.

(f and the function output are int32_t, but the conversion of uint32_t
to int32_t is implementation-defined when the value cannot be
represented, not undefined.  We check in configure.ac that the
platform is two's complement.)

(Discovered by OSS-Fuzz.)
---

diff --git a/src/lib/krb5/asn.1/asn1_k_encode.c b/src/lib/krb5/asn.1/asn1_k_encode.c
index ad5a18a24c..1a250c98c0 100644
--- a/src/lib/krb5/asn.1/asn1_k_encode.c
+++ b/src/lib/krb5/asn.1/asn1_k_encode.c
@@ -250,7 +250,7 @@ decode_krb5_flags(const taginfo *t, const uint8_t *asn1, size_t len, void *val)
         return ret;
     /* Copy up to 32 bits into f, starting at the most significant byte. */
     for (i = 0; i < blen && i < 4; i++)
-        f |= bits[i] << (8 * (3 - i));
+        f |= (uint32_t)bits[i] << (8 * (3 - i));
     *(krb5_flags *)val = f;
     free(bits);
     return 0;