Heap Corruption with large authorization header values

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view
|

Heap Corruption with large authorization header values

Tim Vega
Hello,

We have mod_auth_kerb 5.4 running with krb5-1.12.2

When sending a request with a very large authorization value, 12462 characters and sample attached, the kerberos library encounters a heap corruption somewhere in a call to gss_accept_sec_context.
The data that appears to be corrupted is pointed to by the variable mechtok_out in spnego_gss_accept_sec_context in lib/gssapi/spnego/spnego_mech.c. The corruption gets detected by a call to gss_release_buffer in the cleanup routine of the same function.

Has anyone seen this before? Is this expected behavior given a large auth header?

Tim



_______________________________________________
krbdev mailing list             [hidden email]
https://mailman.mit.edu/mailman/listinfo/krbdev

largeheader.txt (17K) Download Attachment