Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1361831

[PATCH RESEND v2 08/14] lib/mpi: mpi_read_buffer(): fix buffer overflow

Show all headers | View raw

Currently, mpi_read_buffer() writes full limbs to the output buffer
and moves memory around to purge leading zero limbs afterwards.

However, with

  commit 9cbe21d8f89d ("lib/mpi: only require buffers as big as needed for
                        the integer")

the caller is only required to provide a buffer large enough to hold the
result without the leading zeros.

This might result in a buffer overflow for small MP numbers with leading
zeros.

Fix this by coping the result to its final destination within the output
buffer and not copying the leading zeros at all.

Fixes: 9cbe21d8f89d ("lib/mpi: only require buffers as big as needed for
                      the integer")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
---
 lib/mpi/mpicoder.c | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index a999ee1..27582e2 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -201,16 +201,9 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes,
 #else
 #error please implement for this limb size.
 #endif
-		memcpy(p, &alimb, BYTES_PER_MPI_LIMB);
-		p += BYTES_PER_MPI_LIMB;
-		if (lzeros > 0) {
-			mpi_limb_t *limb1 = (void *)p - sizeof(alimb);
-			mpi_limb_t *limb2 = (void *)p - sizeof(alimb)
-				+ lzeros;
-			*limb1 = *limb2;
-			p -= lzeros;
-			lzeros -= sizeof(alimb);
-		}
+		memcpy(p, &alimb + lzeros, BYTES_PER_MPI_LIMB - lzeros);
+		p += BYTES_PER_MPI_LIMB - lzeros;
+		lzeros = 0;
 	}
 	return 0;
 }
-- 
2.7.3

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH RESEND v2 00/14] lib/mpi: bug fixes and cleanup Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 05/14] lib/mpi: mpi_write_sgl(): replace open coded endian conversion Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 06/14] lib/mpi: mpi_read_buffer(): optimize skipping of leading zero limbs Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 12/14] lib/mpi: mpi_read_raw_from_sgl(): fix nbits calculation Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 10/14] lib/mpi: mpi_read_raw_from_sgl(): don't include leading zero SGEs in nbytes Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 07/14] lib/mpi: mpi_read_buffer(): replace open coded endian conversion Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 08/14] lib/mpi: mpi_read_buffer(): fix buffer overflow Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 13/14] lib/mpi: mpi_read_raw_from_sgl(): sanitize meaning of indices Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 14/14] lib/mpi: mpi_read_raw_from_sgl(): fix out-of-bounds buffer access Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 11/14] lib/mpi: mpi_read_raw_from_sgl(): purge redundant clearing of nbits Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:30 +0100
  [PATCH RESEND v2 03/14] lib/mpi: mpi_write_sgl(): purge redundant pointer arithmetic Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:40 +0100
  [PATCH RESEND v2 02/14] lib/mpi: mpi_write_sgl(): fix style issue with lzero decrement Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:40 +0100
  [PATCH RESEND v2 04/14] lib/mpi: mpi_write_sgl(): fix out-of-bounds stack access Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:40 +0100
  [PATCH RESEND v2 01/14] lib/mpi: mpi_write_sgl(): fix skipping of leading zero limbs Nicolai Stange <nicstange@gmail.com> - 2016-03-21 14:40 +0100
  Re: [PATCH RESEND v2 00/14] lib/mpi: bug fixes and cleanup Tadeusz Struk <tadeusz.struk@intel.com> - 2016-03-22 06:00 +0100
    Re: [PATCH RESEND v2 00/14] lib/mpi: bug fixes and cleanup Nicolai Stange <nicstange@gmail.com> - 2016-03-22 08:10 +0100
      Re: [PATCH RESEND v2 00/14] lib/mpi: bug fixes and cleanup Tadeusz Struk <tadeusz.struk@intel.com> - 2016-03-22 15:20 +0100

csiph-web