@@ -3132,6 +3132,48 @@ int test_debug(void)
31323132 return 0 ;
31333133}
31343134
3135+ int test_bad_challenge (struct ntlm_ctx * ctx )
3136+ {
3137+ struct ntlm_buffer challenge = { T_ServerChallenge , 8 };
3138+ struct ntlm_buffer message = { 0 };
3139+ struct wire_chal_msg * msg ;
3140+ uint32_t type ;
3141+ uint32_t flags ;
3142+ char * target_name = NULL ;
3143+ uint8_t chal [8 ];
3144+ struct ntlm_buffer rchallenge = { chal , 8 };
3145+ int ret ;
3146+
3147+ /* check we can decode encode/decode NULL target_name */
3148+ flags = T_NTLMv1 .ChallengeFlags &
3149+ ~(NTLMSSP_TARGET_TYPE_SERVER | NTLMSSP_TARGET_TYPE_DOMAIN );
3150+ flags |= NTLMSSP_NEGOTIATE_UNICODE ;
3151+
3152+ ret = ntlm_encode_chal_msg (ctx , flags , NULL ,
3153+ & challenge , NULL , & message );
3154+ if (ret ) return ret ;
3155+
3156+ /* Doctor the message to set back NTLMSSP_TARGET_TYPE_SERVER */
3157+ msg = (struct wire_chal_msg * )message .data ;
3158+ msg -> neg_flags |= NTLMSSP_TARGET_TYPE_SERVER ;
3159+
3160+ ret = ntlm_decode_msg_type (ctx , & message , & type );
3161+ if (ret ) return ret ;
3162+ if (type != 2 ) return EINVAL ;
3163+
3164+ ret = ntlm_decode_chal_msg (ctx , & message , & flags , & target_name ,
3165+ & rchallenge , NULL );
3166+ if (ret ) return ret ;
3167+
3168+ if (target_name != NULL ) {
3169+ ret = EINVAL ;
3170+ free (target_name );
3171+ }
3172+ free (message .data );
3173+
3174+ return ret ;
3175+ }
3176+
31353177int main (int argc , const char * argv [])
31363178{
31373179 struct ntlm_ctx * ctx ;
@@ -3367,6 +3409,11 @@ int main(int argc, const char *argv[])
33673409 fprintf (stderr , "Test: %s\n" , (ret ? "FAIL" :"SUCCESS" ));
33683410 if (ret ) gret ++ ;
33693411
3412+ fprintf (stderr , "Test Bad Challenge Message\n" );
3413+ ret = test_bad_challenge (ctx );
3414+ fprintf (stderr , "Test: %s\n" , (ret ? "FAIL" :"SUCCESS" ));
3415+ if (ret ) gret ++ ;
3416+
33703417 fprintf (stderr , "Test Acquired cred from with no name\n" );
33713418 ret = test_ACQ_NO_NAME ();
33723419 fprintf (stderr , "Test: %s\n" , (ret ? "FAIL" :"SUCCESS" ));
0 commit comments