lkml.org 
[lkml]   [2014]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] Potential NULL pointer deference in drbg_ctr_df
Date
The handling of additional input data / personalization string data may
be subject to a NULL pointer deference for the CTR DRBG. The
caller-provided data may be NULL which must be caught by the DRBG.

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Stephan Mueller <smueller@chronox.de>
---
crypto/drbg.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/crypto/drbg.c b/crypto/drbg.c
index faaa2ce..8e7c302 100644
--- a/crypto/drbg.c
+++ b/crypto/drbg.c
@@ -513,17 +513,20 @@ static int drbg_ctr_df(struct drbg_state *drbg,
drbg_string_fill(&S2, L_N, sizeof(L_N));
drbg_string_fill(&S4, pad, padlen);
S1.next = &S2;
- S2.next = addtl;

- /*
- * splice in addtl between S2 and S4 -- we place S4 at the end of the
- * input data chain
- */
- tempstr = addtl;
- for (; NULL != tempstr; tempstr = tempstr->next)
- if (NULL == tempstr->next)
- break;
- tempstr->next = &S4;
+ if (NULL == addtl) {
+ S2.next = &S4;
+ } else {
+ /*
+ * splice in addtl between S2 and S4 -- we place S4 at the end
+ * of the input data chain
+ */
+ S2.next = addtl;
+ tempstr = addtl;
+ while (tempstr->next)
+ tempstr = tempstr->next;
+ tempstr->next = &S4;
+ }

/* 10.4.2 step 9 */
while (templen < (drbg_keylen(drbg) + (drbg_blocklen(drbg)))) {
--
1.9.3



\
 
 \ /
  Last update: 2014-06-21 15:01    [W:0.114 / U:5.904 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site