Brad Fitzpatrick
999d053994
parseGSSAPIPayload overwrote the remaining payload with the trailing bytes returned by asn1.Unmarshal after decoding each OID, so any request offering more than one mechanism failed to parse after the first one. Track the remaining payload across iterations instead, and be strict: reject payloads with trailing bytes after an OID or after the mechanism list. Add a test with a two-mechanism payload (Kerberos V5 followed by SPNEGO) that failed before this change. Change-Id: If0984efcf103da76323d5d03ad7443d8ec9d3aed Reviewed-on: https://go-review.googlesource.com/c/crypto/+/803180 Reviewed-by: Carlos Amedee <carlos@golang.org> Reviewed-by: Nicola Murino <nicola.murino@gmail.com> Reviewed-by: David Chase <drchase@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Go Cryptography
This repository holds supplementary Go cryptography packages.
Report Issues / Send Patches
This repository uses Gerrit for code changes. To learn how to submit changes to this repository, see https://go.dev/doc/contribute.
The git repository is https://go.googlesource.com/crypto.
The main issue tracker for the crypto repository is located at https://go.dev/issues. Prefix your issue with "x/crypto:" in the subject line, so it is easy to find.
Note that contributions to the cryptography package receive additional scrutiny due to their sensitive nature. Patches may take longer than normal to receive feedback.