73 lines
2.1 KiB
Diff
73 lines
2.1 KiB
Diff
|
From 114b31ab5b7e6965b629697020a7ce4b6cea340e Mon Sep 17 00:00:00 2001
|
||
|
|
From: Daniel Stenberg <daniel@haxx.se>
|
||
|
|
Date: Mon, 13 Aug 2018 10:35:52 +0200
|
||
|
|
Subject: [PATCH] Curl_ntlm_core_mk_nt_hash: return error on too long password
|
||
|
|
|
||
|
|
... since it would cause an integer overflow if longer than (max size_t
|
||
|
|
/ 2).
|
||
|
|
|
||
|
|
This is CVE-2018-14618
|
||
|
|
|
||
|
|
Bug: https://curl.haxx.se/docs/CVE-2018-14618.html
|
||
|
|
Closes #2756
|
||
|
|
Reported-by: Zhaoyang Wu
|
||
|
|
|
||
|
|
Upstream-commit: 57d299a499155d4b327e341c6024e293b0418243
|
||
|
|
Signed-off-by: Kamil Dudka <kdudka@redhat.com>
|
||
|
|
---
|
||
|
|
lib/curl_ntlm_core.c | 23 +++++++++++++----------
|
||
|
|
1 file changed, 13 insertions(+), 10 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c
|
||
|
|
index e896276..e5c785d 100644
|
||
|
|
--- a/lib/curl_ntlm_core.c
|
||
|
|
+++ b/lib/curl_ntlm_core.c
|
||
|
|
@@ -143,6 +143,15 @@
|
||
|
|
#define NTLMv2_BLOB_SIGNATURE "\x01\x01\x00\x00"
|
||
|
|
#define NTLMv2_BLOB_LEN (44 -16 + ntlm->target_info_len + 4)
|
||
|
|
|
||
|
|
+#ifndef SIZE_T_MAX
|
||
|
|
+/* some limits.h headers have this defined, some don't */
|
||
|
|
+#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
|
||
|
|
+#define SIZE_T_MAX 18446744073709551615U
|
||
|
|
+#else
|
||
|
|
+#define SIZE_T_MAX 4294967295U
|
||
|
|
+#endif
|
||
|
|
+#endif
|
||
|
|
+
|
||
|
|
/*
|
||
|
|
* Turns a 56-bit key into being 64-bit wide.
|
||
|
|
*/
|
||
|
|
@@ -557,8 +566,11 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struct Curl_easy *data,
|
||
|
|
unsigned char *ntbuffer /* 21 bytes */)
|
||
|
|
{
|
||
|
|
size_t len = strlen(password);
|
||
|
|
- unsigned char *pw = len ? malloc(len * 2) : strdup("");
|
||
|
|
+ unsigned char *pw;
|
||
|
|
CURLcode result;
|
||
|
|
+ if(len > SIZE_T_MAX/2) /* avoid integer overflow */
|
||
|
|
+ return CURLE_OUT_OF_MEMORY;
|
||
|
|
+ pw = len ? malloc(len * 2) : strdup("");
|
||
|
|
if(!pw)
|
||
|
|
return CURLE_OUT_OF_MEMORY;
|
||
|
|
|
||
|
|
@@ -646,15 +658,6 @@ CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen,
|
||
|
|
return CURLE_OK;
|
||
|
|
}
|
||
|
|
|
||
|
|
-#ifndef SIZE_T_MAX
|
||
|
|
-/* some limits.h headers have this defined, some don't */
|
||
|
|
-#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
|
||
|
|
-#define SIZE_T_MAX 18446744073709551615U
|
||
|
|
-#else
|
||
|
|
-#define SIZE_T_MAX 4294967295U
|
||
|
|
-#endif
|
||
|
|
-#endif
|
||
|
|
-
|
||
|
|
/* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode
|
||
|
|
* (uppercase UserName + Domain) as the data
|
||
|
|
*/
|
||
|
|
--
|
||
|
|
2.17.1
|
||
|
|
|