Fix bug #9213 - Bad ASN.1 NegTokenInit packet can cause invalid free.

[samba.git] / source3 / libsmb / clispnego.c

diff --git a/source3/libsmb/clispnego.c b/source3/libsmb/clispnego.c
index e20749b3e8af57e4263409f67120d20b68bd6197..49b484b56c2405fc69198c2644da46412f38d497 100644 (file)
--- a/source3/libsmb/clispnego.c
+++ b/source3/libsmb/clispnego.c
@@ -4,7 +4,7 @@
    Copyright (C) Andrew Tridgell 2001
    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
    Copyright (C) Luke Howard     2003
-   
+
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 3 of the License, or
@@ -21,6 +21,7 @@
 
 #include "includes.h"
 #include "../libcli/auth/spnego.h"
+#include "smb_krb5.h"
 
 /*
   generate a negTokenInit packet given a GUID, a list of supported
@@ -135,6 +136,10 @@ bool spnego_parse_negTokenInit(DATA_BLOB blob,
        bool ret;
        ASN1_DATA *data;
 
+       for (i = 0; i < ASN1_MAX_OIDS; i++) {
+               OIDs[i] = NULL;
+       }
+
        data = asn1_init(talloc_tos());
        if (data == NULL) {
                return false;
@@ -145,14 +150,24 @@ bool spnego_parse_negTokenInit(DATA_BLOB blob,
        asn1_start_tag(data,ASN1_APPLICATION(0));
 
        asn1_check_OID(data,OID_SPNEGO);
+
+       /* negTokenInit  [0]  NegTokenInit */
        asn1_start_tag(data,ASN1_CONTEXT(0));
        asn1_start_tag(data,ASN1_SEQUENCE(0));
 
+       /* mechTypes [0] MechTypeList  OPTIONAL */
+
+       /* Not really optional, we depend on this to decide
+        * what mechanisms we have to work with. */
+
        asn1_start_tag(data,ASN1_CONTEXT(0));
        asn1_start_tag(data,ASN1_SEQUENCE(0));
        for (i=0; asn1_tag_remaining(data) > 0 && i < ASN1_MAX_OIDS-1; i++) {
                const char *oid_str = NULL;
                asn1_read_OID(data,talloc_autofree_context(),&oid_str);
+               if (data->has_error) {
+                       break;
+               }
                OIDs[i] = CONST_DISCARD(char *, oid_str);
        }
        OIDs[i] = NULL;
@@ -160,11 +175,45 @@ bool spnego_parse_negTokenInit(DATA_BLOB blob,
        asn1_end_tag(data);
 
        *principal = NULL;
-       if (asn1_tag_remaining(data) > 0) {
+
+       /*
+         Win7 + Live Sign-in Assistant attaches a mechToken
+         ASN1_CONTEXT(2) to the negTokenInit packet
+         which breaks our negotiation if we just assume
+         the next tag is ASN1_CONTEXT(3).
+       */
+
+       if (asn1_peek_tag(data, ASN1_CONTEXT(1))) {
+               uint8 flags;
+
+               /* reqFlags [1] ContextFlags  OPTIONAL */
+               asn1_start_tag(data, ASN1_CONTEXT(1));
+               asn1_start_tag(data, ASN1_BIT_STRING);
+               while (asn1_tag_remaining(data) > 0) {
+                       asn1_read_uint8(data, &flags);
+               }
+               asn1_end_tag(data);
+               asn1_end_tag(data);
+       }
+
+       if (asn1_peek_tag(data, ASN1_CONTEXT(2))) {
+               /* mechToken [2] OCTET STRING  OPTIONAL */
+               DATA_BLOB token;
+               asn1_start_tag(data, ASN1_CONTEXT(2));
+               asn1_read_OctetString(data, talloc_autofree_context(),
+                       &token);
+               asn1_end_tag(data);
+               /* Throw away the token - not used. */
+               data_blob_free(&token);
+       }
+
+       if (asn1_peek_tag(data, ASN1_CONTEXT(3))) {
+               /* mechListMIC [3] OCTET STRING  OPTIONAL */
                asn1_start_tag(data, ASN1_CONTEXT(3));
                asn1_start_tag(data, ASN1_SEQUENCE(0));
                asn1_start_tag(data, ASN1_CONTEXT(0));
-               asn1_read_GeneralString(data,talloc_autofree_context(),principal);
+               asn1_read_GeneralString(data,talloc_autofree_context(),
+                       principal);
                asn1_end_tag(data);
                asn1_end_tag(data);
                asn1_end_tag(data);
@@ -389,7 +438,7 @@ int spnego_gen_negTokenTarg(const char *principal, int time_offset,
        /* get a kerberos ticket for the service and extract the session key */
        retval = cli_krb5_get_ticket(principal, time_offset,
                                        &tkt, session_key_krb5, extra_ap_opts, NULL, 
-                                       expire_time);
+                                       expire_time, NULL);
 
        if (retval)
                return retval;