morgan/FreeRDP
1
0
Fork 0
mirror of https://github.com/morgan9e/FreeRDP synced 2026-04-14 00:14:11 +09:00
Code Issues Packages Projects Releases Wiki Activity

[channels,rdpear] Enforce kerberos string length limits

Browse Source
This commit is contained in:
akallabeth
2025-03-13 12:18:17 +01:00
parent da049b2f96
commit ee7e607562
1 changed files with 26 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
channels/rdpear/client/rdpear_main.c
View File

@@ -42,6 +42,10 @@
#define TAG CHANNELS_TAG("rdpear.client")
#ifndef MAX_KEYTAB_NAME_LEN
#define MAX_KEYTAB_NAME_LEN 1100 /* Defined in MIT krb5.h */
#endif
/* defined in libkrb5 */
krb5_error_code encode_krb5_authenticator(const krb5_authenticator* rep, krb5_data** code_out);
krb5_error_code encode_krb5_ap_rep(const krb5_ap_rep* rep, krb5_data** code_out);
@@ -515,15 +519,33 @@ static BOOL rdpear_kerb_CreateApReqAuthenticator(RDPEAR_PLUGIN* rdpear, NdrConte
for (int i = 0; i < client.length; i++)
{
client.data[i].data = KERB_RPC_UNICODESTR_to_charptr(&req.ClientName->Names[i]);
if (!client.data[i].data)
krb5_data* cur = &client.data[i];
cur->data = KERB_RPC_UNICODESTR_to_charptr(&req.ClientName->Names[i]);
if (!cur->data)
goto out;
client.data[i].length = (unsigned int)strnlen(client.data[i].data, UINT32_MAX);
const size_t len = strnlen(cur->data, MAX_KEYTAB_NAME_LEN + 1);
if (len > MAX_KEYTAB_NAME_LEN)
{
WLog_ERR(TAG,
"Invalid ClientName length %" PRIuz
", limited to %u characters. ClientName: (%s)",
MAX_KEYTAB_NAME_LEN, len, cur->data);
goto out;
}
cur->length = (unsigned int)len;
}
client.realm.data = KERB_RPC_UNICODESTR_to_charptr(req.ClientRealm);
if (!client.realm.data)
goto out;
client.realm.length = (unsigned int)strnlen(client.realm.data, UINT32_MAX);
const size_t len = strnlen(client.realm.data, MAX_KEYTAB_NAME_LEN + 1);
if (len > MAX_KEYTAB_NAME_LEN)
{
WLog_ERR(TAG, "Invalid realm length %" PRIuz ", limited to %u characters. Realm: (%s)",
MAX_KEYTAB_NAME_LEN, len, client.realm.data);
goto out;
}
client.realm.length = (unsigned int)len;
authent.client = &client;
krb5_checksum checksum;