lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 21 Dec 2022 11:37:09 +0100 From: Roberto Sassu <roberto.sassu@...weicloud.com> To: dhowells@...hat.com, herbert@...dor.apana.org.au, davem@...emloft.net, zohar@...ux.ibm.com, dmitry.kasatkin@...il.com, paul@...l-moore.com, jmorris@...ei.org, serge@...lyn.com Cc: linux-integrity@...r.kernel.org, linux-security-module@...r.kernel.org, keyrings@...r.kernel.org, linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org, Roberto Sassu <roberto.sassu@...weicloud.com> Subject: [PATCH v3 1/2] lib/mpi: Fix buffer overrun when SG is too long From: Herbert Xu <herbert@...dor.apana.org.au> The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes. Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") Reported-by: Roberto Sassu <roberto.sassu@...weicloud.com> Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au> --- lib/mpi/mpicoder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c index 39c4c6731094..3cb6bd148fa9 100644 --- a/lib/mpi/mpicoder.c +++ b/lib/mpi/mpicoder.c @@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) while (sg_miter_next(&miter)) { buff = miter.addr; - len = miter.length; + len = min_t(unsigned, miter.length, nbytes); + nbytes -= len; for (x = 0; x < len; x++) { a <<= 8; -- 2.25.1
Powered by blists - more mailing lists