Wrong length compared in SSPI bridge

XMLWordPrintable

        In gss_compare_name(), there is [1]:

            if (l1 < l2 && l1 != r2
                    || l2 < l1 && l2 != l1) {
                return GSS_S_COMPLETE; // different
            }

        If one name is "user@R" and the other is "user1". This check fails fast when one "user" and "user1" already have different length.

        The comparison should be symmetric and the last check should be l2 != r1.

        This bug is reported at [2].

        [1] https://github.com/openjdk/jdk/blob/51d5164ca2b4801c14466e8d1420ecf27cb7615f/src/java.security.jgss/windows/native/libsspi_bridge/sspi.cpp#L467
        [2] http://mail.openjdk.java.net/pipermail/security-dev/2020-September/022643.html

              Assignee:
              Weijun Wang
              Reporter:
              Weijun Wang
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: