Add unit tests for NTLMv1 portable implementation

net/http/http_auth_handler_ntlm_portable.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_ntlm.h"
 
 #include <stdlib.h>
 // For gethostname
 #if defined(OS_POSIX)
 #include <unistd.h>
 #elif defined(OS_WIN)
 #include <winsock2.h>
 #endif
 
 #include "base/md5.h"
 #include "base/rand_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "net/base/net_errors.h"
 #include "net/base/network_interfaces.h"
-#include "net/http/des.h"
-#include "net/http/md4.h"
+#include "net/ntlm/des.h"
+#include "net/ntlm/md4.h"
 
 namespace net {
 
 // Based on mozilla/security/manager/ssl/src/nsNTLMAuthModule.cpp,
 // CVS rev. 1.14.
 //
 // TODO(wtc):
 // - The IS_BIG_ENDIAN code is not tested.
 // - Enable the logging code or just delete it.
 // - Delete or comment out the LM code, which hasn't been tested and isn't
@@ skipping 322 matching lines @@
   if (memcmp(cursor, NTLM_TYPE2_MARKER, sizeof(NTLM_TYPE2_MARKER)) != 0)
     return ERR_UNEXPECTED;
   cursor += sizeof(NTLM_TYPE2_MARKER);
 
   // read target name security buffer
   uint32_t target_len = ReadUint16(cursor);
   ReadUint16(cursor);                    // discard next 16-bit value
   uint32_t offset = ReadUint32(cursor);  // get offset from in_buf
   msg->target_len = 0;
   msg->target = NULL;
-  // Check the offset / length combo is in range of the input buffer, including
-  // integer overflow checking.
-  if (offset + target_len > offset && offset + target_len <= in_len) {
-    msg->target_len = target_len;
-    msg->target = ((const uint8_t*)in_buf) + offset;
+
+  // Target length 0 is valid and indicates no target information.
+  if (target_len != 0) {
+    // Check the offset / length combo is in range of the input buffer,
+    // including integer overflow checking.
+    if (offset + target_len > offset && offset + target_len <= in_len) {

[Ryan Sleevi, 2017/07/12 17:56:38]

if (target_len <= in_len && in_len - offset >= target_len) ?

[asanka, 2017/07/13 17:26:13]

Ping

[zentaro, 2017/07/13 17:36:20]

Sorry. I didn't see this one.

Changed it. Though this code was always here. Plus it's about to get deleted :)

+      msg->target_len = target_len;
+      msg->target = ((const uint8_t*)in_buf) + offset;
+    } else {
+      // Reject a message with a non-zero target length that
+      // would cause an overflow.
+      return ERR_UNEXPECTED;
+    }
   }
 
   // read flags
   msg->flags = ReadUint32(cursor);
 
   // read challenge
   memcpy(msg->challenge, cursor, sizeof(msg->challenge));
   cursor += sizeof(msg->challenge);
 
   NTLM_LOG(("NTLM type 2 message:\n"));
@@ skipping 277 matching lines @@
   // of NTLM.
   std::unique_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNTLM);
   if (!tmp_handler->InitFromChallenge(challenge, target, ssl_info, origin,
                                       net_log))
     return ERR_INVALID_RESPONSE;
   handler->swap(tmp_handler);
   return OK;
 }
 
 }  // namespace net