romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 20:13:35 +03:00
Code Issues Projects Releases Packages Wiki Activity

socks: reject zero-length GSSAPI/SSPI tokens from proxy

Browse source 
A "broken" SOCKS5 proxy can send an invalid length of the encryption
token, which could cause malloc(0) to be called, which is a "platform
can do what it wants" potential problem.

Resolve this by explicitly checking the length and rejecting the invalid
token before ever attempting to allocate any memory.

Closes #21159
This commit is contained in:
Greg Kroah-Hartman 2026-03-30 15:33:54 +02:00 • committed by Daniel Stenberg
parent 930f2e8227
commit fb6925c243
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 23 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

13
lib/socks_gssapi.c
View file

@ -266,6 +266,13 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
memcpy(&us_length, socksreq + 2, sizeof(short));
us_length = ntohs(us_length);
if(!us_length) {
failf(data, "Invalid zero-length GSS-API authentication token.");
gss_release_name(&gss_status, &server);
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
gss_recv_token.length = us_length;
gss_recv_token.value = curlx_malloc(gss_recv_token.length);
if(!gss_recv_token.value) {
@ -453,6 +460,12 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
memcpy(&us_length, socksreq + 2, sizeof(short));
us_length = ntohs(us_length);
if(!us_length) {
failf(data, "Invalid zero-length GSS-API encryption token.");
Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
return CURLE_COULDNT_CONNECT;
}
gss_recv_token.length = us_length;
gss_recv_token.value = curlx_malloc(gss_recv_token.length);
if(!gss_recv_token.value) {

10
lib/socks_sspi.c
View file

@ -223,6 +223,11 @@ static CURLcode socks5_sspi_loop(struct Curl_cfilter *cf,
memcpy(&us_length, socksreq + 2, sizeof(short));
us_length = ntohs(us_length);
if(!us_length) {
failf(data, "Invalid zero-length SSPI authentication token.");
return CURLE_COULDNT_CONNECT;
}
sspi_recv_token.cbBuffer = us_length;
sspi_recv_token.pvBuffer = curlx_malloc(us_length);
@ -400,6 +405,11 @@ static CURLcode socks5_sspi_encrypt(struct Curl_cfilter *cf,
memcpy(&us_length, socksreq + 2, sizeof(short));
us_length = ntohs(us_length);
if(!us_length) {
failf(data, "Invalid zero-length SSPI encryption token.");
return CURLE_COULDNT_CONNECT;
}
sspi_w_token[0].cbBuffer = us_length;
sspi_w_token[0].pvBuffer = curlx_malloc(us_length);
if(!sspi_w_token[0].pvBuffer)