43 lines
1.2 KiB
Diff
43 lines
1.2 KiB
Diff
From f54763bc90df9c76c69ee9a837cf856bcf93e633 Mon Sep 17 00:00:00 2001
|
|
From: Greg Hudson <ghudson@mit.edu>
|
|
Date: Tue, 5 Mar 2024 17:38:49 -0500
|
|
Subject: [PATCH] Fix leak in KDC NDR encoding
|
|
|
|
If the KDC tries to encode a principal containing encode invalid UTF-8
|
|
sequences for inclusion in a PAC delegation info buffer, it will leak
|
|
a small amount of memory in enc_wchar_pointer() before failing. Fix
|
|
the leak.
|
|
|
|
ticket: 9115 (new)
|
|
tags: pullup
|
|
target_version: 1.21-next
|
|
|
|
(cherry picked from commit 7d0d85bf99caf60c0afd4dcf91b0c4c683b983fe)
|
|
---
|
|
src/kdc/ndr.c | 3 +--
|
|
1 file changed, 1 insertion(+), 2 deletions(-)
|
|
|
|
diff --git a/src/kdc/ndr.c b/src/kdc/ndr.c
|
|
index 48395abe52..d438408ee2 100644
|
|
--- a/src/kdc/ndr.c
|
|
+++ b/src/kdc/ndr.c
|
|
@@ -96,14 +96,13 @@ enc_wchar_pointer(const char *utf8, struct encoded_wchars *encoded_out)
|
|
size_t utf16len, num_wchars;
|
|
uint8_t *utf16;
|
|
|
|
- k5_buf_init_dynamic(&b);
|
|
-
|
|
ret = k5_utf8_to_utf16le(utf8, &utf16, &utf16len);
|
|
if (ret)
|
|
return ret;
|
|
|
|
num_wchars = utf16len / 2;
|
|
|
|
+ k5_buf_init_dynamic(&b);
|
|
k5_buf_add_uint32_le(&b, num_wchars + 1);
|
|
k5_buf_add_uint32_le(&b, 0);
|
|
k5_buf_add_uint32_le(&b, num_wchars);
|
|
--
|
|
2.44.0
|
|
|