Re: Fixed Challenge/response sizes in Squid's NTLMSSP code

On Tue, 2004-07-13 at 18:20, Andrew Bartlett wrote:
> While I've been trying to code up the 'Negotiate' (SPNEGO) support for
> Squid, I have seen a lot of:
>
> ntlm_request->authchallenge = xstrndup(reply, NTLM_CHALLENGE_SZ
> + 5);
>
> These worry me - not only are these packets not fixed size, Squid has no
> way of knowing what they should be!

Ah. NTLM_CHALLENGE_SZ was found in a samba header IIRC. (AN OOLLDD)
samba header. So, I'd be ecstatic to see a patch for 3.0 (and 2.5 :}) to
correct this.

> There are parts of the NTLMSSP protocol that can expand - like the DNS
> and domain names - send by both clients and servers. I'm worried that
> artificial limitations will just bite some unfortunate user. (I found
> a similar issue in Samba, where a only the BBC had enough servers to
> fill a fixed-length buffer. It took months to track down...)
>
> Is there any reason not to simply use strdup() here?

yes. xstrndup is a safe function that truncates at the expected length,
and uses our alloc wrappers. likewise there is xstrdup for no truncation
- and there is no reason not to use xstrdup.

Rob

-- 
GPG key available at: <http://www.robertcollins.net/keys.txt>.