From 6476809e81a43f8b7152b7183a8dfc26e8f3df0e Mon Sep 17 00:00:00 2001
From: Clinton Thomas <1033162+KernelClint@users.noreply.github.com>
Date: Wed, 26 Aug 2026 13:25:46 -0400
Subject: [PATCH] kerberos: reject encryption types wider than Int32

AI-Assisted: yes (GPT-5.6-Cyber)
---
 scapy/layers/kerberos.py | 14 +++++++++++++-
 test/regression.uts      |  5 +++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/scapy/layers/kerberos.py b/scapy/layers/kerberos.py
index 904449b860e..b3f874d79eb 100644
--- a/scapy/layers/kerberos.py
+++ b/scapy/layers/kerberos.py
@@ -374,10 +374,22 @@ def fromSPN(spn: str):
 }
 
 
+class _KRBInt32Field(ASN1F_enum_INTEGER):
+    def m2i(self, pkt, s):
+        s = self._apply_tagging_dec(s, pkt, _fname=self.name)
+        codec = self.ASN1_tag.get_codec(pkt.ASN1_codec)
+        if codec.check_type_get_len(s)[0] > 5:
+            raise BER_Decoding_Error(
+                "Kerberos integer is wider than 32 bits", remaining=s
+            )
+        dec = codec.safedec if self.flexible_tag else codec.dec
+        return dec(s, context=self.context, **self._codec_kwargs(pkt))
+
+
 class EncryptedData(ASN1_Packet):
     ASN1_codec = ASN1_Codecs.BER
     ASN1_root = ASN1F_SEQUENCE(
-        ASN1F_enum_INTEGER("etype", 0x17, _KRB_E_TYPES, explicit_tag=0xA0),
+        _KRBInt32Field("etype", 0x17, _KRB_E_TYPES, explicit_tag=0xA0),
         ASN1F_optional(UInt32("kvno", None, explicit_tag=0xA1)),
         ASN1F_STRING("cipher", "", explicit_tag=0xA2),
     )
diff --git a/test/regression.uts b/test/regression.uts
index 53bdbad16c3..3a3ecb874f0 100644
--- a/test/regression.uts
+++ b/test/regression.uts
@@ -1503,6 +1503,11 @@ assert pkt.json() == '{"length": null, "id": 0, "qr": 0, "opcode": 0, "aa": 0, "
 pkt = KRB_AP_REP(bytes(KRB_AP_REP(encPart=EncryptedData())))
 assert pkt.command() == "KRB_AP_REP(pvno=ASN1_INTEGER(5), msgType=ASN1_INTEGER(15), encPart=EncryptedData(etype=ASN1_INTEGER(23), kvno=None, cipher=ASN1_STRING(b'')))"
 
+= KRB AP REP rejects encryption type wider than Int32
+wide = KerberosTCPHeader(hex_bytes("000000206f1e301ca003020105a10302010fa210300ea0080206010101010101a2020400"))
+assert Raw in wide
+assert KRB_AP_REP not in wide
+
 = Test json(à with ASN.1 packet
 
 assert pkt.json() == '{"pvno": {"type": "ASN1_INTEGER", "value": "5"}, "msgType": {"type": "ASN1_INTEGER", "value": "15"}, "encPart": {"etype": {"type": "ASN1_INTEGER", "value": "23"}, "kvno": null, "cipher": {"type": "ASN1_STRING", "value": ""}}}'