- add another check in decrypt_internal_special()

prompted by miod@
ok miod@ deraadt@

1 files changed, 6 insertions, 0 deletions

diff --git a/kerberosV/src/lib/krb5/crypto.c b/kerberosV/src/lib/krb5/crypto.c
index 94e87d5c769..f82732052db 100644
--- a/kerberosV/src/lib/krb5/crypto.c
+++ b/kerberosV/src/lib/krb5/crypto.c
@@ -3603,6 +3603,12 @@ decrypt_internal_special(krb5_context context,
 	return KRB5_BAD_MSIZE;
     }
 
+    if (len < cksum_sz + et->confoundersize) {
+	krb5_set_error_string(context, "Encrypted data shorter then "
+				  "checksum + confunder");
+	return KRB5_BAD_MSIZE;
+    }
+
     p = malloc (len);
     if (p == NULL) {
 	krb5_set_error_string(context, "malloc: out of memory");