From 9f94f856785d1d5f848d9a72d9c3728a825fc73e Mon Sep 17 00:00:00 2001
From: Alexey Tikhonov <atikhono@redhat.com>
Date: Tue, 4 Aug 2026 20:51:07 +0200
Subject: [PATCH] pam: validate auth_token_length in extract_authtok_v1()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The check mimics one existing in `extract_authtok_v2()`

:fixes: CVE-2026-68743

Assisted-By: Claude Code (Opus 4.6)
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Sumit Bose <sbose@redhat.com>
Reference: https://github.com/SSSD/sssd/commit/9f94f856785d1d5f848d9a72d9c3728a825fc73e.patch
Conflict: NA

---
 src/responder/pam/pamsrv_cmd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index c289023dfa7..0fff340f657 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -450,6 +450,11 @@ static int extract_authtok_v1(struct sss_auth_token *tok,
 
     SAFEALIGN_COPY_UINT32_CHECK(&auth_token_type, &body[*c], blen, c);
     SAFEALIGN_COPY_UINT32_CHECK(&auth_token_length, &body[*c], blen, c);
+
+    if (*c + auth_token_length > blen || SIZE_T_OVERFLOW(*c, auth_token_length)) {
+        return EINVAL;
+    }
+
     auth_token_data = body+(*c);
 
     switch (auth_token_type) {