linux-kernel - array underflow in receive

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 27 Mar 2012 10:10:36 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	Philipp Reisner <philipp.reisner@...bit.com>
Cc:	drbd-user@...ts.linbit.com, linux-kernel@...r.kernel.org
Subject: array underflow in receive_SyncParam()?

I had a question about the following code:

drivers/block/drbd/drbd_receiver.c
  2808                  if (apv == 88) {
  2809                          if (data_size > SHARED_SECRET_MAX) {
  2810                                  dev_err(DEV, "verify-alg too long, "
  2811                                      "peer wants %u, accepting only %u byte\n",
  2812                                                  data_size, SHARED_SECRET_MAX);
  2813                                  return false;
  2814                          }
  2815  
  2816                          if (drbd_recv(mdev, p->verify_alg, data_size) != data_size)
  2817                                  return false;
  2818  
  2819                          /* we expect NUL terminated string */
  2820                          /* but just in case someone tries to be evil */
  2821                          D_ASSERT(p->verify_alg[data_size-1] == 0);
  2822                          p->verify_alg[data_size-1] = 0;
                                              ^^^^^^^^^
Is it possible for data_size to be zero here leading to an array
underflow?  We test for overflows, but I don't see any place where we
test for zero.

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/