| Subject: | Access null strings in decode_challenge |
using apache2 mod_ntlm2, the challenge string is sometimes < 48
characters, so the decode_challenge function tries to access values off
the end of the string. Here's patch which solves the warnings in the
least intrusive manner:
--- /usr/local/perl/5.8.5/lib/site_perl/5.8.5/Authen/NTLM.pm
2008-06-18 06:56:08.000000000 -0400
+++ /export/home/ut0598/tmp/Authen/NTLM.pm 2008-10-09
12:33:51.194737000 -0400
@@ -360,7 +360,9 @@
my (@res, @hdr);
my $original = $challenge;
- $res->{buffer} = substr($challenge, $msg2_hlen);
+ $res->{buffer} = $msg2_hlen < length $challenge
+ ? substr($challenge, $msg2_hlen) : '';
+
$challenge = substr($challenge, 0, $msg2_hlen);
@res = unpack($msg2, $challenge);
$res->{ident} = $res[0];
@@ -373,7 +375,7 @@
$res->{data} = $res[4];
$res->{reserved} = $res[5];
$res->{empty_hdr} = $res[6];
- @hdr = unpack($str_hdr, $res[6]);
+ @hdr = length($res[6]) ? unpack($str_hdr, $res[6]) : (0,0,0);
$res->{target}{len} = $hdr[0];
$res->{target}{maxlen} = $hdr[1];
$res->{target}{offset} = $hdr[2];