Hi,

On Wed, Feb 11, 2015 at 1:06 AM, Steve Holme <steve_holme_at_hotmail.com> wrote:

>> The old code was:
>> token.length = strlen(service) + 1 + strlen(proxy ? conn->proxy.name :
>> conn->host.name) + 1;
>
> Yeah - I couldn't quite work out which part of that code was right and which was wrong - especially as the length assignment seems to contradict the length check underneath it.
>
> For example: If the SPN happened to be 2047 characters long (I know this is unlikely and hypothetical but please bear with me here)...
>
> So let's use a 4 character service name such as "HTTP", then there is 1 character for the at sign, 2042 characters for the hostname and 1 character for the null terminator. This would fill the 2048 character buffer and token.length would equal 2048 with the old code. However, the following "if check" would then fail as "2048 + 1 > 2048" would be true.
>
> That coupled with a) what we already do in socks_gssapi.c Line 151 (Not my code) and b) my SASL based GSS-API code (that formed the basis for that commit) seemed to tell me this code is wrong. I also appreciate there appears to be some contradictory code in socks_gssapi.c if I have understood the code correctly - in the instance where "serviceptr" contains a '/' as it doesn't allocate space for the null terminator and then uses memcpy to copy the string without the null terminator where as the code when "serviceptr" doesn't contain a "/" includes the null terminator in the buffer (using snprintf()) but doesn't include it in the descriptors length.

Right, I guess I've jumped to conclusions just because I was
frustrated of my unpronounceable error.
It was also silly to mix it in this patch, I'll make sure to keep the
next version strictly related to the proposed improvement.

> However, I'm no GSS-API expert and sasl_gssapi.c was my first attempt at programming against a GSS-API library - so I will quite happily bow down to anyone with greater experience and knowledge than me here ;-)

That makes two of us :)

Regards,
Isaac B.

-------------------------------------------------------------------
List admin: http://cool.haxx.se/list/listinfo/curl-library
Etiquette: http://curl.haxx.se/mail/etiquette.html
Received on 2015-02-12