kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libkmipclient: Limit the nesting level of KMIP STRUCTURE recursion

Browse Source 
KMIP STRUCTURE elements can be nested, which causes a recursion of
functions kmip_decode_ttlv(), kmip_decode_xml(), and kmip_decode_json().
A malformed KMIP response may thus cause stack exhaustion.

Limit the KMIP STRUCTURE nesting level to 32 levels. This is more than
enough for currently defined KMIP responses. The practically used
nesting level is 8 or 9, dependent on the type of KMIP response.

Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-30 10:19:17 +02:00
committed by Jan Höppner
parent f0bf1985c3
commit 5fdeaab3d0
6 changed files with 43 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
libkmipclient/https.c
View File

@@ -735,7 +735,8 @@ int kmip_connection_https_perform(struct kmip_connection *conn,
switch (conn->config.encoding) {
case KMIP_ENCODING_TTLV:
rc = kmip_decode_ttlv(write_cb.ttlv.resp_mem_bio, NULL,
response, debug);
response, KMIP_DECODE_MAX_NESTING_LEVEL,
debug);
if (rc != 0) {
kmip_debug(debug, "kmip_decode_ttlv failed");
goto out;
@@ -750,7 +751,7 @@ int kmip_connection_https_perform(struct kmip_connection *conn,
}
rc = kmip_decode_json(write_cb.json.resp_obj, NULL, response,
debug);
KMIP_DECODE_MAX_NESTING_LEVEL, debug);
if (rc != 0) {
kmip_debug(debug, "kmip_decode_json failed");
goto out;
@@ -768,7 +769,8 @@ int kmip_connection_https_perform(struct kmip_connection *conn,
rc = kmip_decode_xml(xmlDocGetRootElement(
write_cb.xml.ctx->myDoc),
NULL, response, debug);
NULL, response,
KMIP_DECODE_MAX_NESTING_LEVEL, debug);
if (rc != 0) {
kmip_debug(debug, "kmip_decode_xml failed");
goto out;