7cb5e39f36
Daniel Stenberg
2025-09-24
Subject
socks_gssapi: reject too long tokens
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/socks_gssapi.c+3 -1
| @@ -195,7 +195,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf, | |
| if(gss_token != GSS_C_NO_BUFFER) | |
| gss_release_buffer(&gss_status, &gss_recv_token); | |
| if(check_gss_err(data, gss_major_status, | |
| - | gss_minor_status, "gss_init_sec_context")) { |
| + | gss_minor_status, "gss_init_sec_context") || |
| + | /* the size needs to fit in a 16 bit field */ |
| + | (gss_send_token.length > 0xffff)) { |
| gss_release_name(&gss_status, &server); | |
| gss_release_buffer(&gss_status, &gss_recv_token); | |
| gss_release_buffer(&gss_status, &gss_send_token); | |