git: 6742ff42ab3b - main - heimdal: Fix bus fault when zero-length request received

From: Cy Schubert <cy_at_FreeBSD.org>
Date: Thu, 01 Dec 2022 14:24:34 UTC
The branch main has been updated by cy:

URL: https://cgit.FreeBSD.org/src/commit/?id=6742ff42ab3b6e65239f975314060b1393e22d62

commit 6742ff42ab3b6e65239f975314060b1393e22d62
Author:     Cy Schubert <cy@FreeBSD.org>
AuthorDate: 2022-12-01 00:11:18 +0000
Commit:     Cy Schubert <cy@FreeBSD.org>
CommitDate: 2022-12-01 14:24:12 +0000

    heimdal: Fix bus fault when zero-length request received
    
    Zero length client requests result in a bus fault when attempting to
    free malloc()ed pointers within the requests softc. Return an error
    when the request is zero length.
    
    PR:             268062
    Reported by:    Robert Morris <rtm@lcs.mit.edu>
    MFC after:      3 days
---
 crypto/heimdal/lib/krb5/read_message.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/crypto/heimdal/lib/krb5/read_message.c b/crypto/heimdal/lib/krb5/read_message.c
index 4e9bd012dd67..e994b0f09133 100644
--- a/crypto/heimdal/lib/krb5/read_message.c
+++ b/crypto/heimdal/lib/krb5/read_message.c
@@ -55,6 +55,11 @@ krb5_read_message (krb5_context context,
 	return HEIM_ERR_EOF;
     }
     len = (buf[0] << 24) | (buf[1] << 16) | (buf[2] << 8) | buf[3];
+    if (len == 0) {
+	krb5_clear_error_message(context);
+	return HEIM_ERR_EOF;
+    }
+
     ret = krb5_data_alloc (data, len);
     if (ret) {
 	krb5_clear_error_message(context);