[19498] in Kerberos_V5_Development
Re: Local buffer too small to hold opaque_auth data in
daemon@ATHENA.MIT.EDU (Greg Hudson)
Fri Sep 23 13:12:13 2016
To: Tomas Kuthan <tomas.kuthan@oracle.com>, krbdev@mit.edu
From: Greg Hudson <ghudson@mit.edu>
Message-ID: <6416ec8d-f3ce-5cf3-0132-7e92be467d51@mit.edu>
Date: Fri, 23 Sep 2016 13:12:02 -0400
MIME-Version: 1.0
In-Reply-To: <57E39A16.4090006@oracle.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 09/22/2016 04:45 AM, Tomas Kuthan wrote:
> 299 u_char rpchdr[128];
>
> This feels unnecessarily limiting. At least since CVE-2007-3999 there is
> no buffer overflow (lines 311-314), but still, it seems some valid
> messages might get rejected just because their size exceeds 128.
>
> Is there a reason for having the local buffer be 128 B only?
I have no specific insight into this code, which is really old. What
goes into opaque_auth data? (I looked through the code, but it wasn't
obvious.) Is this restriction creating a practical problem?
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
