Validate offset / length of extra field in the message. Note these fields are...

net/http/http_auth_handler_ntlm.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_ntlm.h"
 
 #include <stdlib.h>
 // For gethostname
 #if defined(OS_POSIX)
 #include <unistd.h>
@@ skipping 393 matching lines @@
   if (memcmp(cursor, NTLM_SIGNATURE, sizeof(NTLM_SIGNATURE)) != 0)
     return ERR_UNEXPECTED;
   cursor += sizeof(NTLM_SIGNATURE);
 
   // verify Type-2 marker
   if (memcmp(cursor, NTLM_TYPE2_MARKER, sizeof(NTLM_TYPE2_MARKER)) != 0)
     return ERR_UNEXPECTED;
   cursor += sizeof(NTLM_TYPE2_MARKER);
 
   // read target name security buffer
-  msg->target_len = ReadUint16(cursor);
+  uint32 target_len = ReadUint16(cursor);
   ReadUint16(cursor);  // discard next 16-bit value
   uint32 offset = ReadUint32(cursor);  // get offset from in_buf
-  msg->target = ((const uint8*) in_buf) + offset;
+  msg->target_len = 0;
+  msg->target = NULL;
+  // Check the offset / length combo is in range of the input buffer, including
+  // integer overflow checking.
+  if (offset + target_len > offset && offset + target_len <= in_len) {

[wtc, 2009/07/13 18:07:30]

Should we return ERR_UNEXPECTED or some other error code if
this is false?

+    msg->target_len = target_len;
+    msg->target = ((const uint8*) in_buf) + offset;
+  }
 
   // read flags
   msg->flags = ReadUint32(cursor);
 
   // read challenge
   memcpy(msg->challenge, cursor, sizeof(msg->challenge));
   cursor += sizeof(msg->challenge);
 
   NTLM_LOG(("NTLM type 2 message:\n"));
   LogBuf("target", (const uint8*) msg->target, msg->target_len);
@@ skipping 348 matching lines @@
     rv = GenerateType1Msg(out_token, out_token_len);
   }
 
   if (rv == OK)
     LogToken("out-token", *out_token, *out_token_len);
 
   return rv;
 }
 
 }  // namespace net