From a54ba07a3a01f21de64ecabaafcc01b40b9db5a4 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Wed, 2 Jan 2019 20:33:08 +0100 Subject: [PATCH 1/3] NTLM: fix size check condition for type2 received data Reported-by: Wenxiang Qian --- lib/vauth/ntlm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/lib/vauth/ntlm.c +++ b/lib/vauth/ntlm.c @@ -180,10 +180,11 @@ target_info_len = Curl_read16_le(&buffer[40]); target_info_offset = Curl_read32_le(&buffer[44]); if(target_info_len > 0) { - if(((target_info_offset + target_info_len) > size) || + if((target_info_offset >= size) || + ((target_info_offset + target_info_len) > size) || (target_info_offset < 48)) { infof(data, "NTLM handshake failure (bad type-2 message). " - "Target Info Offset Len is set incorrect by the peer\n"); + "Target Info Offset Len is set incorrect by the peer\n"); return CURLE_BAD_CONTENT_ENCODING; }