lkml.org 
[lkml]   [2017]   [May]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 05/43] crypto: testmgr - fix out of bound read in __test_aead()
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jerome Marchand <jmarchan@redhat.com>

    commit abfa7f4357e3640fdee87dfc276fd0f379fb5ae6 upstream.

    __test_aead() reads MAX_IVLEN bytes from template[i].iv, but the
    actual length of the initialisation vector can be shorter.
    The length of the IV is already calculated earlier in the
    function. Let's just reuses that. Also the IV length is currently
    calculated several time for no reason. Let's fix that too.
    This fix an out-of-bound error detected by KASan.

    Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Cc: Julia Lawall <julia.lawall@lip6.fr>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    crypto/testmgr.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/crypto/testmgr.c
    +++ b/crypto/testmgr.c
    @@ -488,6 +488,8 @@ static int __test_aead(struct crypto_aea
    aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
    tcrypt_complete, &result);

    + iv_len = crypto_aead_ivsize(tfm);
    +
    for (i = 0, j = 0; i < tcount; i++) {
    if (template[i].np)
    continue;
    @@ -508,7 +510,6 @@ static int __test_aead(struct crypto_aea

    memcpy(input, template[i].input, template[i].ilen);
    memcpy(assoc, template[i].assoc, template[i].alen);
    - iv_len = crypto_aead_ivsize(tfm);
    if (template[i].iv)
    memcpy(iv, template[i].iv, iv_len);
    else
    @@ -617,7 +618,7 @@ static int __test_aead(struct crypto_aea
    j++;

    if (template[i].iv)
    - memcpy(iv, template[i].iv, MAX_IVLEN);
    + memcpy(iv, template[i].iv, iv_len);
    else
    memset(iv, 0, MAX_IVLEN);


    \
     
     \ /
      Last update: 2017-05-02 00:05    [W:4.047 / U:0.248 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site