fix remote exploit in kadmind; from lha@stacken.kth.se. ok hin@

1 files changed, 7 insertions, 0 deletions

diff --git a/kerberosV/src/kadmin/version4.c b/kerberosV/src/kadmin/version4.c
index 4274408091d..9407aab07eb 100644
--- a/kerberosV/src/kadmin/version4.c
+++ b/kerberosV/src/kadmin/version4.c
@@ -822,6 +822,13 @@ decode_packet(krb5_context context,
     off += _krb5_get_int(msg + off, &rlen, 4);
     memset(&authent, 0, sizeof(authent));
     authent.length = message.length - rlen - KADM_VERSIZE - 4;
+
+    if(authent.length >= MAX_KTXT_LEN) {
+       krb5_warnx(context, "received bad rlen (%lu)", (unsigned long)rlen);
+       make_you_loose_packet (KADM_LENGTH_ERROR, reply);
+       return;
+    }
+
     memcpy(authent.dat, (char*)msg + off, authent.length);
     off += authent.length;