From ced0a00f97d9f165e6c7725f0d335b1a3411a478 Mon Sep 17 00:00:00 2001
From: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Date: Sun, 31 May 2026 12:48:11 +1200
Subject: [PATCH 18/23] CVE-2026-58216: kdc:kpasswd: calculate correct size for password blob

We were making the enc_data_blob 6 bytes too big.

Its payload is an ASN.1 structure that knows its own size, so the
extra bytes are not usually read by Heimdal, but a crafted packet
could force them to be read.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=16087

Reported-by: Tristan <TristanInSec@gmail.com>
Signed-off-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---
 source4/kdc/kpasswd-service.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source4/kdc/kpasswd-service.c b/source4/kdc/kpasswd-service.c
index c671eb46d07..0284fb4f133 100644
--- a/source4/kdc/kpasswd-service.c
+++ b/source4/kdc/kpasswd-service.c
@@ -137,7 +137,7 @@ kdc_code kpasswd_process(struct kdc_server *kdc,
 
 	ap_req_blob = data_blob_const(&request->data[HEADER_LEN], ap_req_len);
 
-	enc_data_len = len - ap_req_len;
+	enc_data_len = len - (ap_req_len + HEADER_LEN);
 	enc_data_blob = data_blob_const(&request->data[HEADER_LEN + ap_req_len],
 					enc_data_len);
 
-- 
2.43.0


