Emmanuel Lécharny created DIRAPI-470:
----------------------------------------
Summary: 5-byte BER INTEGER in [2^31,2^32) silently wraps negative
Key: DIRAPI-470
URL: https://issues.apache.org/jira/browse/DIRAPI-470
Project: Directory Client API
Issue Type: Bug
Affects Versions: 2.1.8
Reporter: Emmanuel Lécharny
Fix For: 2.1.9
An unauthenticated client sends a _searchRequest_ with a _pagedResults_ control
whose size is _02 05 00 FF FF FF FF (4294967295)_.
_IntegerDecoder_ returns -1, the grammar's negative-means-MAX fix-up turns it
into _Integer.MAX_VALUE_, and the server treats the malformed out-of-range size
as an unlimited page instead of a protocol error.
A hostile server can plant wrapped negatives in _endTransaction_/_AdDirSync_
fields the same way.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
