lkml.org 
[lkml]   [2011]   [Jan]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] Trusted and Encrypted Keys: fix up TSS_rawhmac() so we always kfree() and remember to call va_end()
In security/keys/trusted_defined.c::TSS_rawhmac() we may leak the storage 
allocated to 'sdesc' if
data = va_arg(argp, unsigned char *);
results in a NULL 'data' and we then leave the function by returning
-EINVAL. We also neglect calling va_end(argp) in that case and furthermore
we neglect va_end(argp) if
ret = crypto_shash_update(&sdesc->shash, data, dlen);
results in ret being negative and we then jump to the 'out' label.

I believe this patch takes care of these issues. Please review and
consider for inclusion.

Signed-off-by: Jesper Juhl <jj@chaosbits.net>
---
trusted_defined.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)

compile tested only.

diff --git a/security/keys/trusted_defined.c b/security/keys/trusted_defined.c
index 975e9f2..0ec7ab8 100644
--- a/security/keys/trusted_defined.c
+++ b/security/keys/trusted_defined.c
@@ -101,16 +101,18 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key,
if (dlen == 0)
break;
data = va_arg(argp, unsigned char *);
- if (data == NULL)
- return -EINVAL;
+ if (data == NULL) {
+ ret = -EINVAL;
+ goto out;
+ }
ret = crypto_shash_update(&sdesc->shash, data, dlen);
if (ret < 0)
goto out;
}
- va_end(argp);
if (!ret)
ret = crypto_shash_final(&sdesc->shash, digest);
out:
+ va_end(argp);
kfree(sdesc);
return ret;
}


--
Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/
Don't top-post http://www.catb.org/~esr/jargon/html/T/top-post.html
Plain text mails only, please.



\
 
 \ /
  Last update: 2011-01-13 23:37    [W:0.107 / U:0.440 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site