krb5/CVE-2007-3999.patch

20 lines
656 B
Diff

*** src/lib/rpc/svc_auth_gss.c (revision 20254)
--- src/lib/rpc/svc_auth_gss.c (local)
***************
*** 339,345 ****
oa = &msg->rm_call.cb_cred;
IXDR_PUT_ENUM(buf, oa->oa_flavor);
IXDR_PUT_LONG(buf, oa->oa_length);
! if (oa->oa_length) {
memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);
buf += RNDUP(oa->oa_length) / sizeof(int32_t);
}
--- 339,345 ----
oa = &msg->rm_call.cb_cred;
IXDR_PUT_ENUM(buf, oa->oa_flavor);
IXDR_PUT_LONG(buf, oa->oa_length);
! if (oa->oa_length && oa->oa_length <= sizeof(rpchdr)) {
memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);
buf += RNDUP(oa->oa_length) / sizeof(int32_t);
}