From a3d4b955305229413eb2ac9ea8c2c9402b42ccb9 Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Apr 17 2019 21:31:48 +0000
Subject: [PATCH 1/2] Revert "Include length when using krb5_c_decrypt()"


This reverts commit 87957caf541114f6f15a495dd7d30556dc5801d9.

Fix didn't properly handle old-style buffers.

Signed-off-by: Robbie Harwood <rharwood@redhat.com>

---

diff --git a/src/gp_export.c b/src/gp_export.c
index aa0a8ec..7ad8037 100644
--- a/src/gp_export.c
+++ b/src/gp_export.c
@@ -193,9 +193,6 @@ done:
     return ret_maj;
 }
 
-/* We need to include a length in our payloads because krb5_c_decrypt() will
- * pad the contents for some enctypes, and gss_import_cred() doesn't like
- * having extra bytes on tokens. */
 static int gp_encrypt_buffer(krb5_context context, krb5_keyblock *key,
                              size_t len, void *buf, octet_string *out)
 {
@@ -203,27 +200,9 @@ static int gp_encrypt_buffer(krb5_context context, krb5_keyblock *key,
     krb5_data data_in;
     krb5_enc_data enc_handle;
     size_t cipherlen;
-    char *packed = NULL;
-    uint32_t netlen;
 
-    if (len > (uint32_t)(-1)) {
-        /* Needs to fit in 4 bytes of payload, so... */
-        ret = ENOMEM;
-        goto done;
-    }
-
-    packed = malloc(len);
-    if (!packed) {
-        ret = errno;
-        goto done;
-    }
-
-    netlen = htonl(len);
-    memcpy(packed, (uint8_t *)&netlen, 4);
-    memcpy(packed + 4, buf, len);
-
-    data_in.length = len + 4;
-    data_in.data = packed;
+    data_in.length = len;
+    data_in.data = buf;
 
     memset(&enc_handle, '\0', sizeof(krb5_enc_data));
 
@@ -261,19 +240,16 @@ static int gp_encrypt_buffer(krb5_context context, krb5_keyblock *key,
     }
 
 done:
-    free(packed);
     free(enc_handle.ciphertext.data);
     return ret;
 }
 
-/* See comment above on gp_encrypt_buffer(). */
 static int gp_decrypt_buffer(krb5_context context, krb5_keyblock *key,
-                             octet_string *in, size_t *len, char *buf)
+                             octet_string *in, size_t *len, void *buf)
 {
     int ret;
     krb5_data data_out;
     krb5_enc_data enc_handle;
-    uint32_t netlen;
 
     memset(&enc_handle, '\0', sizeof(krb5_enc_data));
 
@@ -294,10 +270,7 @@ static int gp_decrypt_buffer(krb5_context context, krb5_keyblock *key,
         return ret;
     }
 
-    /* And handle the padding. */
-    memcpy(&netlen, buf, 4);
-    *len = ntohl(netlen);
-    memmove(buf, buf + 4, *len);
+    *len = data_out.length;
 
     return 0;
 }

From d71f10a44577f854b9ee56fca8259d98b1f976df Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Apr 17 2019 21:35:59 +0000
Subject: [PATCH 2/2] Correctly fix credential padding crash


Signed-off-by: Robbie Harwood <rharwood@redhat.com>

---

diff --git a/src/gp_export.c b/src/gp_export.c
index 7ad8037..444ba8e 100644
--- a/src/gp_export.c
+++ b/src/gp_export.c
@@ -244,6 +244,8 @@ done:
     return ret;
 }
 
+/* WARNING: krb5_c_decrypt() may pad the data with some enctypes!  Be sure to
+ * check your lengths. */
 static int gp_decrypt_buffer(krb5_context context, krb5_keyblock *key,
                              octet_string *in, size_t *len, void *buf)
 {
@@ -475,6 +477,10 @@ uint32_t gp_import_gssx_cred(uint32_t *min, struct gp_call_ctx *gpcall,
         goto done;
     }
 
+    /* Handle any padding from gp_decrypt_buffer() before presenting as a
+     * token. */
+    token.length = htonl(*(uint32_t *) token.value) + 4;
+
     ret_maj = gss_import_cred(&ret_min, &token, out);
     if (ret_maj) {
         GPDEBUG("gss_import_cred failed when importing gssx cred\n");