From ea6d2ddb66ec28097c1fe47e2d0a9ab8c1f3e7c6 Mon Sep 17 00:00:00 2001 From: Joseph Sutton Date: Thu, 21 Sep 2023 12:01:27 +1200 Subject: [PATCH] s4:kdc: Check for overflow before calling smb_krb5_princ_component() MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit smb_krb5_princ_component() takes its component index parameter as ‘int’, not ‘unsigned int’. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15482 Signed-off-by: Joseph Sutton Reviewed-by: Andrew Bartlett --- source4/kdc/db-glue.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c index 2450b58e66f..32ef4041083 100644 --- a/source4/kdc/db-glue.c +++ b/source4/kdc/db-glue.c @@ -912,6 +912,11 @@ static krb5_error_code principal_comp_strcmp_int(krb5_context context, size_t len; krb5_data d; krb5_error_code ret = 0; + + if (component > INT_MAX) { + return EINVAL; + } + if (component >= krb5_princ_size(context, principal)) { /* A non‐existent component compares less than any string. */ *cmp = -1; -- 2.47.3