GNOME Bugzilla – Bug 788037
heap-buffer-overflow in soup_ntlm_parse_challenge()
Last modified: 2017-11-14 08:51:27 UTC
I get this when trying to connect to an Exchange server with NTLM, while the server advertises only Basic authentication. That's when doing an initial POST to https://outlook.office365.com/EWS/Exchange.asmx From the less I could get from gdb: (gdb) f 8 8 0x00007fffeaef7d94 in soup_auth_ntlm_update_connection (auth=0x60e0014936f0 [SoupAuthNTLM], msg=0x6140002a3570 [ESoapMessage], auth_header=0x602002d58830 "NTLM", state=0x603002dac1b0) at soup-auth-ntlm.c:335 335 if (!soup_ntlm_parse_challenge (auth_header + 5, &conn->nonce, (gdb) l 330 } 331 332 if (conn->state == SOUP_NTLM_NEW && !auth_header[4]) 333 return TRUE; 334 335 if (!soup_ntlm_parse_challenge (auth_header + 5, &conn->nonce, 336 priv->domain ? NULL : &priv->domain, 337 &conn->ntlmv2_session)) { 338 conn->state = SOUP_NTLM_FAILED; 339 return FALSE; (gdb) p auth_header[3] $1 = 77 'M' (gdb) p auth_header[4] $2 = 0 '\000' (gdb) p conn->state $3 = SOUP_NTLM_SENT_REQUEST Backtrace follows:
+ Trace 238001
Created attachment 360243 [details] [review] proposed patch Just check buffer bounds before accessing its offset. It fixes it for me and the login to the server seems quicker/smoother too (though just subjectively measured).
Comment on attachment 360243 [details] [review] proposed patch OK. Could also merge with the previous check and maybe that would be cleaner.(start with "if (!auth_header[4]) {" and then have state==NEW and else cases inside; you don't actually need to check "!auth_header[5]" because soup_ntlm_parse_challenge() will correctly return FALSE in that case)
I've been thinking of both cases, when the server returns "NTLM" , but also "NTLM " Just in case of some weird error on the server side (do you remember Yahoo! servers returning "\0" in message headers when they begun to "advertise" OAuth2 authentication method?). I do not have commitable checkout, neither I'm sure which branches to use. Would you mind to commit for me, please?
Created commit 812f7388 in libsoup master (2.60.3+) Created commit b7968983 in libsoup gnome-3-26 (2.60.3+) Created commit 699f83d2 in libsoup gnome-3-24 (2.58.3+) Created commit 1a05e68a in libsoup gnome-3-22 (2.56.2+)