romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-26 09:47:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

ntlm: avoid malloc(0) on zero length user and domain

Browse source 
... and simplify the too-long checks somewhat.

Detected by OSS-Fuzz

Closes #6264
This commit is contained in:
Daniel Stenberg 2020-11-28 22:29:59 +01:00
parent 732398561b
commit 65d2f563fd
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 2 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/curl_ntlm_core.c
View file

@ -580,15 +580,11 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
unsigned char *identity;
CURLcode result = CURLE_OK;
/* we do the length checks below separately to avoid integer overflow risk
on extreme data lengths */
if((userlen > SIZE_T_MAX/2) ||
(domlen > SIZE_T_MAX/2) ||
((userlen + domlen) > SIZE_T_MAX/2))
if((userlen > CURL_MAX_INPUT_LENGTH) || (domlen > CURL_MAX_INPUT_LENGTH))
return CURLE_OUT_OF_MEMORY;
identity_len = (userlen + domlen) * 2;
identity = malloc(identity_len);
identity = malloc(identity_len + 1);
if(!identity)
return CURLE_OUT_OF_MEMORY;