From 80a324386b0d6653a19da6e3eeb28530e2478e5d Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Tue, 7 Dec 2004 23:09:41 +0000
Subject: [PATCH] Rene Bernhardt found and fixed a buffer overrun in the NTLM
code, where libcurl always and unconditionally overwrote a stack-based array
with 3 zero bytes. I edited the fix to make it less likely to occur again
(and added a comment explaining the reason to the buffer size).
---
CHANGES | 5 +++++
RELEASE-NOTES | 3 ++-
lib/http_ntlm.c | 6 ++++--
3 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/CHANGES b/CHANGES
index 3f68e041dc..bdac7b113f 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,11 @@
Changelog
+Daniel (8 December 2004)
+- Rene Bernhardt found and fixed a buffer overrun in the NTLM code, where
+ libcurl always and unconditionally overwrote a stack-based array with 3 zero
+ bytes. This is not an exploitable buffer overflow. No need to get alarmed.
+
Daniel (7 December 2004)
- Fixed so that the final error message is sent to the verbose info "stream"
even if no errorbuffer is set.
diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 79d741d016..503514aa0f 100644
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -25,6 +25,7 @@ This release includes the following changes:
This release includes the following bugfixes:
+ o bad memory access in the NTLM code
o EPSV on multi-homed servers now works correctly
o chunked-encoded transfers could get closed pre-maturely without error
o proxy CONNECT now default timeouts after 3600 seconds
@@ -61,6 +62,6 @@ advice from friends like these:
Tomas Pospisek, Gisle Vanem, Dan Fandrich, Paul Nolan, Andres Garcia,
Tim Sneddon, Ian Gulliver, Jean-Philippe Barrette-LaPierre, Jeff Phillips,
Wojciech Zwiefka, David Phillips, Reinout van Schouwen, Maurice Barnum,
- Richard Atterer
+ Richard Atterer, Rene Bernhardt
Thanks! (and sorry if I forgot to mention someone)
diff --git a/lib/http_ntlm.c b/lib/http_ntlm.c
index dc31e837a2..7de00ada1a 100644
--- a/lib/http_ntlm.c
+++ b/lib/http_ntlm.c
@@ -202,6 +202,8 @@ static void mkhash(char *password,
#endif
)
{
+ /* 21 bytes fits 3 7-bytes chunks, as we use 56 bit (7 bytes) as DES input,
+ and we add three different ones, see the calc_resp() function */
unsigned char lmbuffer[21];
#ifdef USE_NTRESPONSES
unsigned char ntbuffer[21];
@@ -239,7 +241,7 @@ static void mkhash(char *password,
DES_ecb_encrypt((DES_cblock *)magic, (DES_cblock *)(lmbuffer+8),
DESKEY(ks), DES_ENCRYPT);
- memset(lmbuffer+16, 0, 5);
+ memset(lmbuffer+16, 0, sizeof(lmbuffer)-16);
}
/* create LM responses */
calc_resp(lmbuffer, nonce, lmresp);
@@ -260,7 +262,7 @@ static void mkhash(char *password,
MD4_Update(&MD4, pw, 2*len);
MD4_Final(ntbuffer, &MD4);
- memset(ntbuffer+16, 0, 8);
+ memset(ntbuffer+16, 0, sizeof(ntbuffer)-16);
}
calc_resp(ntbuffer, nonce, ntresp);
--
GitLab