------------------------------------------------------------ revno: 13009 revision-id: squid3@treenet.co.nz-20131013133355-c1pwl5iz8mo3bwg8 parent: squid3@treenet.co.nz-20131013133249-xtpts1gpydh1o4ia author: Elmar Vonlanthen committer: Amos Jeffries branch nick: 3.4 timestamp: Sun 2013-10-13 07:33:55 -0600 message: libntlmauth: Fix string field truncation Count of field bytes must begin at 0. Otherwise the decoder truncates 1 byte from the string due to lstring initial state values. Also drop the lstring_zero(s) macro. It is only used in one place and calling it 'zero' obscures that length is non-zero for invalid state. ------------------------------------------------------------ # Bazaar merge directive format 2 (Bazaar 0.90) # revision_id: squid3@treenet.co.nz-20131013133355-c1pwl5iz8mo3bwg8 # target_branch: http://bzr.squid-cache.org/bzr/squid3/3.4 # testament_sha1: 7d0254e504b506b540b8f4ccd23f933296ec1ffd # timestamp: 2013-10-13 13:35:21 +0000 # source_branch: http://bzr.squid-cache.org/bzr/squid3/3.4 # base_revision_id: squid3@treenet.co.nz-20131013133249-\ # xtpts1gpydh1o4ia # # Begin patch === modified file 'lib/ntlmauth/ntlmauth.cc' --- lib/ntlmauth/ntlmauth.cc 2012-09-01 14:38:36 +0000 +++ lib/ntlmauth/ntlmauth.cc 2013-10-13 13:33:55 +0000 @@ -99,8 +99,6 @@ return NTLM_ERR_NONE; } -#define lstring_zero(s) s.str=NULL; s.l=-1; - /** * Fetches a string from the authentication packet. * The lstring data-part may point to inside the packet itself or a temporary static buffer. @@ -119,7 +117,8 @@ lstring rv; char *d; - lstring_zero(rv); + rv.str = NULL; + rv.l = -1; l = le16toh(str->len); o = le32toh(str->offset); @@ -130,6 +129,7 @@ return rv; } rv.str = (char *)packet + o; + rv.l = 0; if ((flags & NTLM_NEGOTIATE_ASCII) == 0) { /* UNICODE string */ unsigned short *s = (unsigned short *)rv.str;