Commit f364181f authored by Jerome Marchand's avatar Jerome Marchand Committed by Sasha Levin

crypto: testmgr - fix out of bound read in __test_aead()

[ Upstream commit abfa7f43 ]

__test_aead() reads MAX_IVLEN bytes from template[i].iv, but the
actual length of the initialisation vector can be shorter.
The length of the IV is already calculated earlier in the
function. Let's just reuses that. Also the IV length is currently
calculated several time for no reason. Let's fix that too.
This fix an out-of-bound error detected by KASan.
Signed-off-by: default avatarJerome Marchand <jmarchan@redhat.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
parent 9800a9a4
...@@ -480,6 +480,8 @@ static int __test_aead(struct crypto_aead *tfm, int enc, ...@@ -480,6 +480,8 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG,
tcrypt_complete, &result); tcrypt_complete, &result);
iv_len = crypto_aead_ivsize(tfm);
for (i = 0, j = 0; i < tcount; i++) { for (i = 0, j = 0; i < tcount; i++) {
if (template[i].np) if (template[i].np)
continue; continue;
...@@ -500,7 +502,6 @@ static int __test_aead(struct crypto_aead *tfm, int enc, ...@@ -500,7 +502,6 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
memcpy(input, template[i].input, template[i].ilen); memcpy(input, template[i].input, template[i].ilen);
memcpy(assoc, template[i].assoc, template[i].alen); memcpy(assoc, template[i].assoc, template[i].alen);
iv_len = crypto_aead_ivsize(tfm);
if (template[i].iv) if (template[i].iv)
memcpy(iv, template[i].iv, iv_len); memcpy(iv, template[i].iv, iv_len);
else else
...@@ -605,7 +606,7 @@ static int __test_aead(struct crypto_aead *tfm, int enc, ...@@ -605,7 +606,7 @@ static int __test_aead(struct crypto_aead *tfm, int enc,
j++; j++;
if (template[i].iv) if (template[i].iv)
memcpy(iv, template[i].iv, MAX_IVLEN); memcpy(iv, template[i].iv, iv_len);
else else
memset(iv, 0, MAX_IVLEN); memset(iv, 0, MAX_IVLEN);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment