From 4031c6c2b004190fdffbc19dab7cd0305a2025b7 Mon Sep 17 00:00:00 2001 From: Amos Jeffries Date: Tue, 9 Aug 2022 23:34:54 +0000 Subject: [PATCH] Bug 3193 pt2: NTLM decoder truncating strings (#1114) The initial bug fix overlooked large 'offset' causing integer wrap to extract a too-short length string. Improve debugs and checks sequence to clarify cases and ensure that all are handled correctly. --- lib/ntlmauth/ntlmauth.cc | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/lib/ntlmauth/ntlmauth.cc b/lib/ntlmauth/ntlmauth.cc index 5d96372906..f00fd51f83 100644 --- a/lib/ntlmauth/ntlmauth.cc +++ b/lib/ntlmauth/ntlmauth.cc @@ -107,10 +107,19 @@ ntlm_fetch_string(const ntlmhdr *packet, const int32_t packet_size, const strhdr int32_t o = le32toh(str->offset); // debug("ntlm_fetch_string(plength=%d,l=%d,o=%d)\n",packet_size,l,o); - if (l < 0 || l > NTLM_MAX_FIELD_LENGTH || o + l > packet_size || o == 0) { - debug("ntlm_fetch_string: insane data (pkt-sz: %d, fetch len: %d, offset: %d)\n", packet_size,l,o); + if (l < 0 || l > NTLM_MAX_FIELD_LENGTH) { + debug("ntlm_fetch_string: insane string length (pkt-sz: %d, fetch len: %d, offset: %d)\n", packet_size,l,o); return rv; } + else if (o <= 0 || o > packet_size) { + debug("ntlm_fetch_string: insane string offset (pkt-sz: %d, fetch len: %d, offset: %d)\n", packet_size,l,o); + return rv; + } + else if (l > packet_size - o) { + debug("ntlm_fetch_string: truncated string data (pkt-sz: %d, fetch len: %d, offset: %d)\n", packet_size,l,o); + return rv; + } + rv.str = (char *)packet + o; rv.l = 0; if ((flags & NTLM_NEGOTIATE_ASCII) == 0) { -- 2.47.2