buffer overflow in krb5_kt_get_name

krb5_kt_get_name() allows the called to specify the size of the buffer to copy
the name into. The size must be big enough for the tailing nul character.

If one specified a buffer length that is precisely the strlen w/o allowing for
the nul - the functions would copy one past the end of the buffer.

No code in our tree would be subject this problem - as buffers in use are 1024
or BUFSIZ....

The logic failure was:

strlen(p+1) vs. strlen(p)+1

The code is essentially duplicated in the three changed files.

Ticket: new

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19137 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/keytab/kt_file.c b/src/lib/krb5/keytab/kt_file.c
index 92947d5936ba49a0edce63e9047cb5c024a39674..fe44ff65ea945fef8e3ed163464f940a76ee13cc 100644 (file)
--- a/src/lib/krb5/keytab/kt_file.c
+++ b/src/lib/krb5/keytab/kt_file.c
@@ -408,7 +408,7 @@ krb5_ktfile_get_name(krb5_context context, krb5_keytab id, char *name, unsigned
     name++;
     len -= strlen(id->ops->prefix)+1;
 
-    if (len < strlen(KTFILENAME(id)+1))
+    if (len < strlen(KTFILENAME(id))+1)
        return(KRB5_KT_NAME_TOOLONG);
     strcpy(name, KTFILENAME(id));
     /* strcpy will NUL-terminate the destination */

diff --git a/src/lib/krb5/keytab/kt_memory.c b/src/lib/krb5/keytab/kt_memory.c
index 76aa31cbf4c041f058a5d77e8653fdbbf3736379..f30c7d7b5a443c92edbd7d64b84870eb47ab5712 100644 (file)
--- a/src/lib/krb5/keytab/kt_memory.c
+++ b/src/lib/krb5/keytab/kt_memory.c
@@ -472,7 +472,7 @@ krb5_mkt_get_name(krb5_context context, krb5_keytab id, char *name, unsigned int
     name++;\r
     len -= strlen(id->ops->prefix)+1;\r
 \r
-    if (len < strlen(KTNAME(id)+1))\r
+    if (len < strlen(KTNAME(id))+1)\r
        return(KRB5_KT_NAME_TOOLONG);\r
     strcpy(name, KTNAME(id));\r
     /* strcpy will NUL-terminate the destination */\r

diff --git a/src/lib/krb5/keytab/kt_srvtab.c b/src/lib/krb5/keytab/kt_srvtab.c
index cb9d9c1bc21931a89d32a1d4fb25231f41ee7d3e..d96cf16617d8930bf12e3b7815fdf5eb406e0a54 100644 (file)
--- a/src/lib/krb5/keytab/kt_srvtab.c
+++ b/src/lib/krb5/keytab/kt_srvtab.c
@@ -266,7 +266,7 @@ krb5_ktsrvtab_get_name(krb5_context context, krb5_keytab id, char *name, unsigne
     name++;
     len -= strlen(id->ops->prefix)+1;
 
-    if (len < strlen(KTFILENAME(id)+1))
+    if (len < strlen(KTFILENAME(id))+1)
        return(KRB5_KT_NAME_TOOLONG);
     strcpy(name, KTFILENAME(id));
     /* strcpy will NUL-terminate the destination */