From fd8fbcd090fdf9623721ac672b320b21f6cf286e Mon Sep 17 00:00:00 2001 From: Miroslav Lichvar Date: Mon, 20 Jul 2020 13:38:22 +0200 Subject: [PATCH] nts: don't allow malformed encrypted extension fields Require data decrypted from the NTS authenticator field to contain correctly formatted extension fields (known or unknown). --- nts_ntp_client.c | 6 ++++-- nts_ntp_server.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/nts_ntp_client.c b/nts_ntp_client.c index 7ac6690..31c0960 100644 --- a/nts_ntp_client.c +++ b/nts_ntp_client.c @@ -352,8 +352,10 @@ extract_cookies(NNC_Instance inst, unsigned char *plaintext, int length) for (parsed = 0; parsed < length; parsed += ef_length) { if (!NEF_ParseSingleField(plaintext, length, parsed, - &ef_length, &ef_type, &ef_body, &ef_body_length)) - break; + &ef_length, &ef_type, &ef_body, &ef_body_length)) { + DEBUG_LOG("Could not parse encrypted EF"); + return 0; + } if (ef_type != NTP_EF_NTS_COOKIE) continue; diff --git a/nts_ntp_server.c b/nts_ntp_server.c index c0d3e06..6ab8fb9 100644 --- a/nts_ntp_server.c +++ b/nts_ntp_server.c @@ -176,8 +176,10 @@ NNS_CheckRequestAuth(NTP_Packet *packet, NTP_PacketInfo *info, uint32_t *kod) for (parsed = 0; parsed < plaintext_length; parsed += ef_length) { if (!NEF_ParseSingleField(plaintext, plaintext_length, parsed, - &ef_length, &ef_type, &ef_body, &ef_body_length)) - break; + &ef_length, &ef_type, &ef_body, &ef_body_length)) { + DEBUG_LOG("Could not parse encrypted EF"); + return 0; + } switch (ef_type) { case NTP_EF_NTS_COOKIE_PLACEHOLDER: