CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob

We were making the enc_data_blob 6 bytes too big.

Its payload is an ASN.1 structure that knows its own size, so the
extra bytes are not usually read by Heimdal, but a crafted packet
could force them to be read.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16087

Reported-by: Tristan <TristanInSec@gmail.com>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source4/kdc/kpasswd-service.c b/source4/kdc/kpasswd-service.c
index c671eb46d07027467a896667ed1e40d001a2f050..0284fb4f1334067ac3927a298bc83797e37ada9f 100644 (file)
--- a/source4/kdc/kpasswd-service.c
+++ b/source4/kdc/kpasswd-service.c
@@ -137,7 +137,7 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
 
        ap_req_blob = data_blob_const(&request->data[HEADER_LEN], ap_req_len);
 
-       enc_data_len = len - ap_req_len;
+       enc_data_len = len - (ap_req_len + HEADER_LEN);
        enc_data_blob = data_blob_const(&request->data[HEADER_LEN + ap_req_len],
                                        enc_data_len);