From 80a324386b0d6653a19da6e3eeb28530e2478e5d Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 7 Dec 2004 23:09:41 +0000 Subject: Rene Bernhardt found and fixed a buffer overrun in the NTLM code, where libcurl always and unconditionally overwrote a stack-based array with 3 zero bytes. I edited the fix to make it less likely to occur again (and added a comment explaining the reason to the buffer size). --- lib/http_ntlm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'lib/http_ntlm.c') diff --git a/lib/http_ntlm.c b/lib/http_ntlm.c index dc31e837a..7de00ada1 100644 --- a/lib/http_ntlm.c +++ b/lib/http_ntlm.c @@ -202,6 +202,8 @@ static void mkhash(char *password, #endif ) { + /* 21 bytes fits 3 7-bytes chunks, as we use 56 bit (7 bytes) as DES input, + and we add three different ones, see the calc_resp() function */ unsigned char lmbuffer[21]; #ifdef USE_NTRESPONSES unsigned char ntbuffer[21]; @@ -239,7 +241,7 @@ static void mkhash(char *password, DES_ecb_encrypt((DES_cblock *)magic, (DES_cblock *)(lmbuffer+8), DESKEY(ks), DES_ENCRYPT); - memset(lmbuffer+16, 0, 5); + memset(lmbuffer+16, 0, sizeof(lmbuffer)-16); } /* create LM responses */ calc_resp(lmbuffer, nonce, lmresp); @@ -260,7 +262,7 @@ static void mkhash(char *password, MD4_Update(&MD4, pw, 2*len); MD4_Final(ntbuffer, &MD4); - memset(ntbuffer+16, 0, 8); + memset(ntbuffer+16, 0, sizeof(ntbuffer)-16); } calc_resp(ntbuffer, nonce, ntresp); -- cgit v1.2.3