From: ghudson@mit.edu Subject: git commit Content-Transfer-Encoding: binary Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Disposition: inline X-Mailer: MIME-tools 5.509 (Entity 5.509) X-RT-Interface: API X-RT-Original-Encoding: ascii RT-Message-ID: Content-Length: 788 Fix null deref in KDC when decoding invalid NDR In ndr_dec_delegation_info(), keep di->transited_services_length valid by incrementing it as we add entries. Otherwise ndr_free_delegation_info() could dereference a null di->transited_services field. Also bound nservices using data->length to prevent inordinately large memory allocations. Credit to OSS-Fuzz for discovering the issues. (cherry picked from commit fa62bd33a0c0889c083999c0289ffa81a5d51e7b) https://github.com/krb5/krb5/commit/fdf193f188005c8ed4cb27558425052b673f89a1 Author: Greg Hudson Commit: fdf193f188005c8ed4cb27558425052b673f89a1 Branch: krb5-1.20 src/kdc/ndr.c | 14 +++++++------- src/kdc/t_ndr.c | 32 +++++++++++++++++++++++++++++--- 2 files changed, 36 insertions(+), 10 deletions(-)