Skip to content

Commit 0f4889a

Browse files
committed
Make gssntlm_import_name_by_mech more robust
This was reported by the GitHub Security Lab team as: - Memory corruption when importing host-based service names (GHSL-2023-014) However the only caller that could cause the issue report in a way that culd lead to memory corruption is the application itself calling gss_import_name with an invalid name buffer containing embedded zeros. This is an invalid name for any GSSAPI mechanism and an incorrect use or incorrect validation on the application side. As such I do not believe this is a security or DoS issue in the gss-ntlmssp code, but will adopt the proposed mitigation anyway as it makes the code more robust in the face of application mistakes. Signed-off-by: Simo Sorce <simo@redhat.com>
1 parent a2517e5 commit 0f4889a

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/gss_names.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -299,7 +299,7 @@ uint32_t gssntlm_import_name_by_mech(uint32_t *minor_status,
299299
set_GSSERR(ENOMEM);
300300
goto done;
301301
}
302-
p = memchr(spn, '@', input_name_buffer->length);
302+
p = strchr(spn, '@');
303303
if (p && input_name_buffer->length == 1) {
304304
free(spn);
305305
spn = p = NULL;

0 commit comments

Comments
 (0)