system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-07-22 02:37:15 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Isilon reported that sec=krb5p NFS mounts had a problem when m_len == 0

Browse source 
for the last mbuf of the list with an encrypted message. This patch replaces
the KASSERT() with code that handles this case.

Reported by:	john.gemignani@isilon.com
Reviewed by:	jhb
MFC after:	2 weeks
This commit is contained in:
Rick Macklem 2013-05-01 22:07:55 +00:00
parent 1bf6b724f1
commit 58217793a2
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=250157
1 changed files with 21 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
sys/kgssapi/krb5/krb5_mech.c
View file

@ -1585,6 +1585,8 @@ m_trim(struct mbuf *m, int len)
struct mbuf *n;
int off;
if (m == NULL)
return;
n = m_getptr(m, len, &off);
if (n) {
n->m_len = off;
@ -1600,7 +1602,7 @@ krb5_unwrap_old(struct krb5_context *kc, struct mbuf **mp, int *conf_state,
uint8_t sgn_alg[2], uint8_t seal_alg[2])
{
OM_uint32 res;
struct mbuf *m, *mlast, *hm, *cm;
struct mbuf *m, *mlast, *hm, *cm, *n;
uint8_t *p, dir;
size_t mlen, tlen, elen, datalen, padlen;
size_t cklen;
@ -1702,9 +1704,25 @@ krb5_unwrap_old(struct krb5_context *kc, struct mbuf **mp, int *conf_state,
/*
* Check the trailing pad bytes.
* RFC1964 specifies between 1<->8 bytes, each with a binary value
* equal to the number of bytes.
*/
KASSERT(mlast->m_len > 0, ("Unexpected empty mbuf"));
padlen = mlast->m_data[mlast->m_len - 1];
if (mlast->m_len > 0)
padlen = mlast->m_data[mlast->m_len - 1];
else {
n = m_getptr(m, tlen + datalen - 1, &i);
/*
* When the position is exactly equal to the # of data bytes
* in the mbuf list, m_getptr() will return the last mbuf in
* the list and an off == m_len for that mbuf, so that case
* needs to be checked as well as a NULL return.
*/
if (n == NULL || n->m_len == i)
return (GSS_S_DEFECTIVE_TOKEN);
padlen = n->m_data[i];
}
if (padlen < 1 || padlen > 8 || padlen > tlen + datalen)
return (GSS_S_DEFECTIVE_TOKEN);
m_copydata(m, tlen + datalen - padlen, padlen, buf);
for (i = 0; i < padlen; i++) {
if (buf[i] != padlen) {