R5Reloaded/r5sdk
1
0
Fork 0
mirror of https://github.com/Mauler125/r5sdk.git synced 2025-02-09 19:15:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix 'CVE-2017-8816'

Browse Source 
Merge: curl/curl@7f2a1df6f5
This commit is contained in:
Kawe Mazidjatari 2023-06-12 19:36:18 +02:00
parent bc2a6ae586
commit e48b68e870
1 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
r5dev/thirdparty/curl/curl_ntlm_core.c vendored
View File

@ -618,6 +618,12 @@ CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen,
return CURLE_OK;
}
#if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
#define SIZE_T_MAX 18446744073709551615U
#else
#define SIZE_T_MAX 4294967295U
#endif
/* This creates the NTLMv2 hash by using NTLM hash as the key and Unicode
* (uppercase UserName + Domain) as the data
*/
@ -627,10 +633,20 @@ CURLcode Curl_ntlm_core_mk_ntlmv2_hash(const char *user, size_t userlen,
unsigned char *ntlmv2hash)
{
/* Unicode representation */
size_t identity_len = (userlen + domlen) * 2;
unsigned char *identity = malloc(identity_len);
size_t identity_len;
unsigned char *identity;
CURLcode result = CURLE_OK;
/* we do the length checks below separately to avoid integer overflow risk
on extreme data lengths */
if((userlen > SIZE_T_MAX/2) ||
(domlen > SIZE_T_MAX/2) ||
((userlen + domlen) > SIZE_T_MAX/2))
return CURLE_OUT_OF_MEMORY;
identity_len = (userlen + domlen) * 2;
identity = malloc(identity_len);
if(!identity)
return CURLE_OUT_OF_MEMORY;