diff options
| author | Miloslav Trmač <mitr@redhat.com> | 2010-11-15 21:43:41 +0100 |
|---|---|---|
| committer | Miloslav Trmač <mitr@redhat.com> | 2010-11-15 21:43:41 +0100 |
| commit | 3724774d26cdf4c067935ba3df5cb4824c201d84 (patch) | |
| tree | 87c44ab5fdc1c355c17f3e4c54ff4a02e45d59d9 /lib | |
| parent | a285eb9f51f59bd3f12426dc574f5bfd7ae2cd04 (diff) | |
| download | ncrypto-3724774d26cdf4c067935ba3df5cb4824c201d84.tar.gz ncrypto-3724774d26cdf4c067935ba3df5cb4824c201d84.tar.xz ncrypto-3724774d26cdf4c067935ba3df5cb4824c201d84.zip | |
Detect integer overflow in cmsg size computation
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/ncrypto_alg.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/lib/ncrypto_alg.c b/lib/ncrypto_alg.c index dcb6e02..3cfda6a 100644 --- a/lib/ncrypto_alg.c +++ b/lib/ncrypto_alg.c @@ -919,7 +919,7 @@ ncr_symm_cipher_change_iv (struct ncr_symm_cipher_session *sess, const void *iv, g_return_val_if_fail (iv != NULL || iv_size == 0, CKR_ARGUMENTS_BAD); /* Implicitly restricts iv_size so that it fits into iv_header.ivlen */ cmsg_space = CMSG_SPACE (sizeof (iv_header) + iv_size); - g_return_val_if_fail (cmsg_space <= sizeof (cmsg_buf), + g_return_val_if_fail (cmsg_space > iv_size && cmsg_space <= sizeof (cmsg_buf), CKR_MECHANISM_PARAM_INVALID); /* The IV might be left pending until the first actual data arrives, saving @@ -967,7 +967,8 @@ symm_cipher_init (struct ncr_symm_cipher_session *sess, bool encrypt, g_return_val_if_fail (param != NULL || param_size == 0, CKR_ARGUMENTS_BAD); /* Implicitly restricts param_size so that it fits into iv.ivlen */ cmsg_space = CMSG_SPACE (sizeof (iv) + param_size); - g_return_val_if_fail (cmsg_space <= sizeof (cmsg_buf), + g_return_val_if_fail (cmsg_space > param_size + && cmsg_space <= sizeof (cmsg_buf), CKR_MECHANISM_PARAM_INVALID); switch (sess->mech) |