From: Greg Hudson <ghudson@mit.edu>
Date: Thu, 12 May 2016 20:03:06 +0000 (-0400)
Subject: Check princ length in krb5_sname_match()
X-Git-Tag: krb5-1.15-beta1~192
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fb9fcfa92fd37221c77e1a4c0b930383e6839e22;p=thirdparty%2Fkrb5.git

Check princ length in krb5_sname_match()

krb5_sname_match() can read past the end of princ's component array in
some circumstances (typically when a keytab contains both "x" and
"x/y" principals).  Add a length check.  Reported by Spencer Jackson.

ticket: 8415
target_version: 1.14-next
target_version: 1.13-next
tags: pullup
---

diff --git a/src/lib/krb5/krb/sname_match.c b/src/lib/krb5/krb/sname_match.c
index 0c7bd39e80..9520dfc11c 100644
--- a/src/lib/krb5/krb/sname_match.c
+++ b/src/lib/krb5/krb/sname_match.c
@@ -36,6 +36,9 @@ krb5_sname_match(krb5_context context, krb5_const_principal matching,
     if (matching->type != KRB5_NT_SRV_HST || matching->length != 2)
         return krb5_principal_compare(context, matching, princ);
 
+    if (princ->length != 2)
+        return FALSE;
+
     /* Check the realm if present in matching. */
     if (matching->realm.length != 0 && !data_eq(matching->realm, princ->realm))
         return FALSE;