moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-08-13 17:03:50 -04:00
Code Issues Releases Wiki Activity

unicode NTLM SSPI: heap corruption fixed

Browse Source 
When compiling libcurl with UNICODE defined and using unicode characters
in username.
This commit is contained in:
Christian Hägele 2012-07-02 22:59:54 +02:00 committed by Daniel Stenberg
parent b3ebfc2b74
commit dd302206ad
1 changed files with 54 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

87
lib/curl_ntlm_msgs.c
View File

@ -351,67 +351,88 @@ CURLcode Curl_ntlm_create_type1_message(const char *userp,
SecBufferDesc desc; SecBufferDesc desc;
SECURITY_STATUS status; SECURITY_STATUS status;
unsigned long attrs; unsigned long attrs;
const char *user; const TCHAR *useranddomain;
const char *domain = ""; const TCHAR *user;
size_t userlen = 0; const TCHAR *passwd;
const TCHAR *domain = TEXT("");
size_t domlen = 0; size_t domlen = 0;
size_t passwdlen = 0;
TimeStamp tsDummy; /* For Windows 9x compatibility of SSPI calls */ TimeStamp tsDummy; /* For Windows 9x compatibility of SSPI calls */
Curl_ntlm_sspi_cleanup(ntlm); Curl_ntlm_sspi_cleanup(ntlm);
user = strchr(userp, '\\'); if(userp && *userp) {
if(!user) #ifdef UNICODE
user = strchr(userp, '/'); useranddomain = Curl_convert_UTF8_to_wchar(userp);
if(useranddomain == NULL)
return CURLE_OUT_OF_MEMORY;
#else
useranddomain = userp;
#endif
if(user) { user = _tcschr(useranddomain, TEXT('\\'));
domain = userp; if(!user)
domlen = user - userp; user = _tcschr(useranddomain, TEXT('/'));
user++;
}
else {
user = userp;
domain = "";
domlen = 0;
}
if(user) if(user) {
userlen = strlen(user); domain = useranddomain;
domlen = user - useranddomain;
user++;
}
else {
user = useranddomain;
domain = TEXT("");
domlen = 0;
}
if(passwdp)
passwdlen = strlen(passwdp);
if(userlen > 0) {
/* note: initialize all of this before doing the mallocs so that /* note: initialize all of this before doing the mallocs so that
* it can be cleaned up later without leaking memory. * it can be cleaned up later without leaking memory.
*/ */
ntlm->p_identity = &ntlm->identity; ntlm->p_identity = &ntlm->identity;
memset(ntlm->p_identity, 0, sizeof(*ntlm->p_identity)); memset(ntlm->p_identity, 0, sizeof(*ntlm->p_identity));
#ifdef UNICODE #ifdef UNICODE
if((ntlm->identity.User = Curl_convert_UTF8_to_wchar(user)) == NULL) if((ntlm->identity.User = (unsigned short *)_wcsdup(user)) == NULL) {
free((void *)useranddomain);
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;
}
#else #else
if((ntlm->identity.User = (unsigned char *)strdup(user)) == NULL) if((ntlm->identity.User = (unsigned char *)strdup(user)) == NULL)
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;
#endif #endif
ntlm->identity.UserLength = (unsigned long)_tcslen(user);
ntlm->identity.UserLength = (unsigned long)userlen; ntlm->identity.Domain = malloc(sizeof(TCHAR) * (domlen + 1));
if(ntlm->identity.Domain == NULL) {
#ifdef UNICODE #ifdef UNICODE
if((ntlm->identity.Password = Curl_convert_UTF8_to_wchar(passwdp)) == NULL) free((void *)useranddomain);
#endif
return CURLE_OUT_OF_MEMORY;
}
_tcsncpy((TCHAR *)ntlm->identity.Domain, domain, domlen);
ntlm->identity.Domain[domlen] = TEXT('\0');
ntlm->identity.DomainLength = (unsigned long)domlen;
#ifdef UNICODE
free((void *)useranddomain);
#endif
#ifdef UNICODE
ntlm->identity.Password = (unsigned short *)
Curl_convert_UTF8_to_wchar(passwdp);
if(ntlm->identity.Password == NULL)
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;
#else #else
if((ntlm->identity.Password = (unsigned char *)strdup(passwdp)) == NULL) if((ntlm->identity.Password = (unsigned char *)strdup(passwdp)) == NULL)
return CURLE_OUT_OF_MEMORY; return CURLE_OUT_OF_MEMORY;
#endif #endif
ntlm->identity.PasswordLength =
(unsigned long)_tcslen((TCHAR *)ntlm->identity.Password);
ntlm->identity.PasswordLength = (unsigned long)passwdlen; #ifdef UNICODE
if((ntlm->identity.Domain = malloc(domlen + 1)) == NULL) ntlm->identity.Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
return CURLE_OUT_OF_MEMORY; #else
strncpy((char *)ntlm->identity.Domain, domain, domlen);
ntlm->identity.Domain[domlen] = '\0';
ntlm->identity.DomainLength = (unsigned long)domlen;
ntlm->identity.Flags = SEC_WINNT_AUTH_IDENTITY_ANSI; ntlm->identity.Flags = SEC_WINNT_AUTH_IDENTITY_ANSI;
#endif
} }
else else
ntlm->p_identity = NULL; ntlm->p_identity = NULL;