Reject object ACE whose header exceeds its declared size

[chiliec]

Problem

ParseACE validates the ACE's declared AceSize against the input length, then for an object ACE advances offset past the ObjectType and InheritedObjectType GUIDs. Those advances are bounded only against len(data), never against aceSize itself:

aceSize := int(binary.LittleEndian.Uint16(data[2:4]))
// ... aceSize >= 8 and len(data) >= aceSize validated ...
offset := 8
if ace.IsObjectACE() {
    // offset can grow to 8 + 4 + 16 + 16 = 44, checked only vs len(data)
}
sid, _, err := ParseSIDBytes(data[offset:aceSize])   // panics if offset > aceSize

A crafted object ACE with a small AceSize (e.g. 12) but ObjectFlags declaring the type GUIDs present pushes offset to 28, so data[offset:aceSize] becomes data[28:12] — an inverted slice range — and Go panics:

panic: runtime error: slice bounds out of range [28:12]

Security descriptors reach ParseACE via ParseSecurityDescriptor → ParseACL on attacker-controlled data: pkg/relay/ldap_attacks.go parses security descriptors returned by an LDAP server, so a malicious/compromised server can crash the tool.

Reproduction

Added TestParseACE_ObjectAceSizeBelowHeaderNoPanic, which builds an object ACE with AceSize = 12 and OBJECT_TYPE_PRESENT. It panics on the current code and passes with the fix.

Fix

Reject an object header that runs past the ACE's own declared size before slicing:

if offset > aceSize {
    return nil, 0, fmt.Errorf("ACE object header of %d bytes exceeds ACE size %d", offset, aceSize)
}

Validation

go test -race ./pkg/security/   # ok
go vet ./pkg/security/          # clean
gofmt -l pkg/security/          # clean

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.