git://git.exim.org
/
exim.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
SPDX: Mass-update to GPL-2.0-or-later
[exim.git]
/
src
/
src
/
auths
/
spa.c
diff --git
a/src/src/auths/spa.c
b/src/src/auths/spa.c
index f83d1144a75f08e415082034c06c136eb5205540..222ccea86fc6741fdf07027082ac1309fda75e6e 100644
(file)
--- a/
src/src/auths/spa.c
+++ b/
src/src/auths/spa.c
@@
-5,6
+5,7
@@
/* Copyright (c) University of Cambridge 1995 - 2018 */
/* Copyright (c) The Exim Maintainers 2020 */
/* See the file NOTICE for conditions of use and distribution. */
/* Copyright (c) University of Cambridge 1995 - 2018 */
/* Copyright (c) The Exim Maintainers 2020 */
/* See the file NOTICE for conditions of use and distribution. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
/* This file, which provides support for Microsoft's Secure Password
Authentication, was contributed by Marc Prud'hommeaux. Tom Kistner added SPA
/* This file, which provides support for Microsoft's Secure Password
Authentication, was contributed by Marc Prud'hommeaux. Tom Kistner added SPA
@@
-141,6
+142,7
@@
SPAAuthResponse response;
SPAAuthResponse *responseptr = &response;
uschar msgbuf[2048];
uschar *clearpass, *s;
SPAAuthResponse *responseptr = &response;
uschar msgbuf[2048];
uschar *clearpass, *s;
+unsigned off;
/* send a 334, MS Exchange style, and grab the client's request,
unless we already have it via an initial response. */
/* send a 334, MS Exchange style, and grab the client's request,
unless we already have it via an initial response. */
@@
-187,10
+189,13
@@
that causes failure if the size of msgbuf is exceeded. ****/
{
int i;
{
int i;
- char * p
= (CS responseptr) + IVAL(&responseptr->uUser.offset,0)
;
+ char * p;
int len = SVAL(&responseptr->uUser.len,0)/2;
int len = SVAL(&responseptr->uUser.len,0)/2;
- if (p + len*2 >= CS (responseptr+1))
+ if ( (off = IVAL(&responseptr->uUser.offset,0)) >= sizeof(SPAAuthResponse)
+ || len >= sizeof(responseptr->buffer)/2
+ || (p = (CS responseptr) + off) + len*2 >= CS (responseptr+1)
+ )
{
DEBUG(D_auth)
debug_printf("auth_spa_server(): bad uUser spec in response\n");
{
DEBUG(D_auth)
debug_printf("auth_spa_server(): bad uUser spec in response\n");
@@
-242,13
+247,14
@@
spa_smb_nt_encrypt(clearpass, challenge.challengeData, ntRespData);
/* compare NT hash (LM may not be available) */
/* compare NT hash (LM may not be available) */
-
s = (US responseptr) +
IVAL(&responseptr->ntResponse.offset,0);
-if (
s + 24 >= US (responseptr+1)
)
+
off =
IVAL(&responseptr->ntResponse.offset,0);
+if (
off >= sizeof(SPAAuthResponse) - 24
)
{
DEBUG(D_auth)
debug_printf("auth_spa_server(): bad ntRespData spec in response\n");
return FAIL;
}
{
DEBUG(D_auth)
debug_printf("auth_spa_server(): bad ntRespData spec in response\n");
return FAIL;
}
+s = (US responseptr) + off;
if (memcmp(ntRespData, s, 24) == 0)
return auth_check_serv_cond(ablock); /* success. we have a winner. */
if (memcmp(ntRespData, s, 24) == 0)
return auth_check_serv_cond(ablock); /* success. we have a winner. */