From fb6925c2434ac527883f9b14ce946ed0e386914f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 30 Mar 2026 15:33:54 +0200 Subject: [PATCH] socks: reject zero-length GSSAPI/SSPI tokens from proxy A "broken" SOCKS5 proxy can send an invalid length of the encryption token, which could cause malloc(0) to be called, which is a "platform can do what it wants" potential problem. Resolve this by explicitly checking the length and rejecting the invalid token before ever attempting to allocate any memory. Closes #21159 --- lib/socks_gssapi.c | 13 +++++++++++++ lib/socks_sspi.c | 10 ++++++++++ 2 files changed, 23 insertions(+) diff --git a/lib/socks_gssapi.c b/lib/socks_gssapi.c index d43f44708c..c40e2a23ee 100644 --- a/lib/socks_gssapi.c +++ b/lib/socks_gssapi.c @@ -266,6 +266,13 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf, memcpy(&us_length, socksreq + 2, sizeof(short)); us_length = ntohs(us_length); + if(!us_length) { + failf(data, "Invalid zero-length GSS-API authentication token."); + gss_release_name(&gss_status, &server); + Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + gss_recv_token.length = us_length; gss_recv_token.value = curlx_malloc(gss_recv_token.length); if(!gss_recv_token.value) { @@ -453,6 +460,12 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf, memcpy(&us_length, socksreq + 2, sizeof(short)); us_length = ntohs(us_length); + if(!us_length) { + failf(data, "Invalid zero-length GSS-API encryption token."); + Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL); + return CURLE_COULDNT_CONNECT; + } + gss_recv_token.length = us_length; gss_recv_token.value = curlx_malloc(gss_recv_token.length); if(!gss_recv_token.value) { diff --git a/lib/socks_sspi.c b/lib/socks_sspi.c index cc0e043887..97ba15deaa 100644 --- a/lib/socks_sspi.c +++ b/lib/socks_sspi.c @@ -223,6 +223,11 @@ static CURLcode socks5_sspi_loop(struct Curl_cfilter *cf, memcpy(&us_length, socksreq + 2, sizeof(short)); us_length = ntohs(us_length); + if(!us_length) { + failf(data, "Invalid zero-length SSPI authentication token."); + return CURLE_COULDNT_CONNECT; + } + sspi_recv_token.cbBuffer = us_length; sspi_recv_token.pvBuffer = curlx_malloc(us_length); @@ -400,6 +405,11 @@ static CURLcode socks5_sspi_encrypt(struct Curl_cfilter *cf, memcpy(&us_length, socksreq + 2, sizeof(short)); us_length = ntohs(us_length); + if(!us_length) { + failf(data, "Invalid zero-length SSPI encryption token."); + return CURLE_COULDNT_CONNECT; + } + sspi_w_token[0].cbBuffer = us_length; sspi_w_token[0].pvBuffer = curlx_malloc(us_length); if(!sspi_w_token[0].pvBuffer)