CVE-2022-42898 source4/heimdal: PAC parse integer overflows
authorJoseph Sutton <josephsutton@catalyst.net.nz>
Fri, 14 Oct 2022 03:45:37 +0000 (16:45 +1300)
committerJule Anger <janger@samba.org>
Tue, 15 Nov 2022 07:18:49 +0000 (08:18 +0100)
commita3816433ae971830c2b16b366b10283aeb5a87b5
tree7a55b0fbdb57f1b404099b614f30d78b2e811084
parent9c909c57ce7abacd96ba18173a9dc4ba9a7c0230
CVE-2022-42898 source4/heimdal: PAC parse integer overflows

Catch overflows that result from adding PAC_INFO_BUFFER_SIZE.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15203

Heavily edited by committer Nico Williams <nico@twosigma.com>, original by
Joseph Sutton <josephsutton@catalyst.net.nz>.

Signed-off-by: Nico Williams <nico@twosigma.com>
[jsutton@samba.org Zero-initialised header_size in krb5_pac_parse() to
 avoid a maybe-uninitialized error; added a missing check for ret == 0]

[jsutton@samba.org Backported to our older version of Heimdal; removed
 lib/krb5/test_pac.c which we don't have]
source4/heimdal/lib/krb5/pac.c