Attachment #185901 for bug #263398

Lines 1815-1821 get_input_token(unsigned char **buff_in, Link Here

(-)krb5-1.6.3/src/lib/gssapi/spnego/spnego_mech.c (-1 / +2 lines)
1815	return (NULL);	1815	return (NULL);
1816		1816
1817	input_token->length = gssint_get_der_length(buff_in, buff_length, &bytes);	1817	input_token->length = gssint_get_der_length(buff_in, buff_length, &bytes);
1818	if ((int)input_token->length == -1) {	1818	if ((int)input_token->length == -1 \|\|
		1819	input_token->length > buff_length) {
1819	free(input_token);	1820	free(input_token);
1820	return (NULL);	1821	return (NULL);
1821	}	1822	}





asn1_error_code asn1buf_imbed(asn1buf *subbuf, const asn1buf *buf, const unsigned int length, const int indef)
{
  if (buf->next > buf->bound + 1) return ASN1_OVERRUN;                                                       
  subbuf->base = subbuf->next = buf->next;
  if (!indef) {
      if (length > (size_t)(buf->bound + 1 - buf->next)) return ASN1_OVERRUN;                                
      subbuf->bound = subbuf->base + length - 1;
      if (subbuf->bound > buf->bound)
	  return ASN1_OVERRUN;
  } else /* constructed indefinite */
      subbuf->bound = buf->bound;
  return 0;

{
  int i;

  if (buf->next > buf->bound + 1) return ASN1_OVERRUN;                                                       
  if (len > buf->bound + 1 - buf->next) return ASN1_OVERRUN;
  if (len == 0) {
      *s = 0;

{
  int i;

  if (buf->next > buf->bound + 1) return ASN1_OVERRUN;                                                       
  if (len > buf->bound + 1 - buf->next) return ASN1_OVERRUN;
  if (len == 0) {
      *s = 0;

Return to bug 263398

Lines 78-88 asn1_error_code asn1buf_wrap_data(asn1bu Link Here

(-)krb5-1.6.3/src/lib/krb5/asn.1/asn1buf.c (-2 / +4 lines)
78		78
79	asn1_error_code asn1buf_imbed(asn1buf subbuf, const asn1buf buf, const unsigned int length, const int indef)	79	asn1_error_code asn1buf_imbed(asn1buf subbuf, const asn1buf buf, const unsigned int length, const int indef)
80	{	80	{
		81	if (buf->next > buf->bound + 1) return ASN1_OVERRUN;
81	subbuf->base = subbuf->next = buf->next;	82	subbuf->base = subbuf->next = buf->next;
82	if (!indef) {	83	if (!indef) {
		84	if (length > (size_t)(buf->bound + 1 - buf->next)) return ASN1_OVERRUN;
83	subbuf->bound = subbuf->base + length - 1;	85	subbuf->bound = subbuf->base + length - 1;
84	if (subbuf->bound > buf->bound)
85	return ASN1_OVERRUN;
86	} else /* constructed indefinite */	86	} else /* constructed indefinite */
87	subbuf->bound = buf->bound;	87	subbuf->bound = buf->bound;
88	return 0;	88	return 0;
Lines 200-205 asn1_error_code asn1buf_remove_octetstri Link Here
200	{	200	{
201	int i;	201	int i;
202		202
		203	if (buf->next > buf->bound + 1) return ASN1_OVERRUN;
203	if (len > buf->bound + 1 - buf->next) return ASN1_OVERRUN;	204	if (len > buf->bound + 1 - buf->next) return ASN1_OVERRUN;
204	if (len == 0) {	205	if (len == 0) {
205	*s = 0;	206	*s = 0;
Lines 218-223 asn1_error_code asn1buf_remove_charstrin Link Here
218	{	219	{
219	int i;	220	int i;
220		221
		222	if (buf->next > buf->bound + 1) return ASN1_OVERRUN;
221	if (len > buf->bound + 1 - buf->next) return ASN1_OVERRUN;	223	if (len > buf->bound + 1 - buf->next) return ASN1_OVERRUN;
222	if (len == 0) {	224	if (len == 0) {
223	*s = 0;	225	*s = 0;