[PATCH] fix out of bound read in __test_aead()

From	"Jerome Marchand" <jmarchan@redhat.com>
Newsgroups	linux.kernel
Subject	[PATCH] fix out of bound read in __test_aead()
Date	2016-01-29 14:20 +0100
Message-ID	<qWh7Y-3Bi-7@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

__test_aead() reads MAX_IVLEN bytes from template[i].iv, but the
actual length of the initialisation vector can be shorter.
The length of the IV is already calculated earlier in the
function. Let's just reuses that.
This fix an out-of-bound error detected by KASan.

Signed-off-by: Jerome Marchand <jmarchan@redhat.com>
---
 crypto/testmgr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/testmgr.c b/crypto/testmgr.c
index ae8c57fd..d3587d5 100644
--- a/crypto/testmgr.c
+++ b/crypto/testmgr.c
@@ -617,7 +617,7 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
 		j++;
 
 		if (template[i].iv)
-			memcpy(iv, template[i].iv, MAX_IVLEN);
+			memcpy(iv, template[i].iv, iv_len);
 		else
 			memset(iv, 0, MAX_IVLEN);
 
-- 
2.5.0

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

[PATCH] fix out of bound read in __test_aead() "Jerome Marchand" <jmarchan@redhat.com> - 2016-01-29 14:20 +0100
  Re: [PATCH] fix out of bound read in __test_aead() Herbert Xu <herbert@gondor.apana.org.au> - 2016-02-01 15:30 +0100
    Re: [PATCH] fix out of bound read in __test_aead() Jerome Marchand <jmarchan@redhat.com> - 2016-02-01 16:50 +0100
  [PATCH v2] fix out of bound read in __test_aead() "Jerome Marchand" <jmarchan@redhat.com> - 2016-02-03 14:00 +0100
    Re: [PATCH v2] fix out of bound read in __test_aead() Herbert Xu <herbert@gondor.apana.org.au> - 2016-02-06 08:50 +0100

csiph-web