[
https://issues.apache.org/jira/browse/DIRAPI-470?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Emmanuel Lécharny closed DIRAPI-470.
------------------------------------
> 5-byte BER INTEGER in [2^31,2^32) silently wraps negative
> ---------------------------------------------------------
>
> Key: DIRAPI-470
> URL: https://issues.apache.org/jira/browse/DIRAPI-470
> Project: Directory Client API
> Issue Type: Bug
> Affects Versions: 2.1.8
> Reporter: Emmanuel Lécharny
> Priority: Minor
> Fix For: 2.1.9
>
>
> An unauthenticated client sends a _searchRequest_ with a _pagedResults_
> control whose size is _02 05 00 FF FF FF FF (4294967295)_.
> _IntegerDecoder_ returns -1, the grammar's negative-means-MAX fix-up turns it
> into _Integer.MAX_VALUE_, and the server treats the malformed out-of-range
> size as an unlimited page instead of a protocol error.
> A hostile server can plant wrapped negatives in _endTransaction_/_AdDirSync_
> fields the same way.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
