lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Wed, 23 Sep 2020 18:06:15 -0700 (PDT)
From:   David Miller <>
Subject: Re: [PATCH net-next] tipc: potential memory corruption in

From: Dan Carpenter <>
Date: Wed, 23 Sep 2020 11:30:17 +0300

> This code uses "skey->keylen" as an memcpy() size and then checks that
> it is valid on the next line.  The other problem is that the check has
> a potential integer overflow, it's better to use struct_size() for this.
> Fixes: 23700da29b83 ("tipc: add automatic rekeying for encryption key")
> Signed-off-by: Dan Carpenter <>
> ---
> Hey Kees and Julia,
> It would be nice to change tipc_aead_key_size() but I'm not sure how the
> UAPI stuff works.  My first attempt at to change it to
> 	return struct_size(key, key, key->keylen);
> broke the build.  I think you guys used Coccinelle to automatically
> update these calculations.  Probably this wasn't updated because you
> didn't want to break the build either?

If it is subject to overflows, the tipc_aead_key_size() helper
shouldn't be used as-is by userspace either.


Please find a way to fix that inline function instead without breaking
UAPI, thank you.

Powered by blists - more mailing lists