diff options
| author | Ard Biesheuvel <[email protected]> | 2021-01-02 13:59:09 +0000 |
|---|---|---|
| committer | Herbert Xu <[email protected]> | 2021-01-02 21:35:35 +0000 |
| commit | 0aa171e9b267ce7c52d3a3df7bc9c1fc0203dec5 (patch) | |
| tree | f998a01d4f059ea5092a6d370e8d3a8832ec6a73 /fs/btrfs/dev-replace.c | |
| parent | crypto: arm/chacha-neon - add missing counter increment (diff) | |
| download | kernel-0aa171e9b267ce7c52d3a3df7bc9c1fc0203dec5.tar.gz kernel-0aa171e9b267ce7c52d3a3df7bc9c1fc0203dec5.zip | |
crypto: ecdh - avoid buffer overflow in ecdh_set_secret()
Pavel reports that commit 17858b140bf4 ("crypto: ecdh - avoid unaligned
accesses in ecdh_set_secret()") fixes one problem but introduces another:
the unconditional memcpy() introduced by that commit may overflow the
target buffer if the source data is invalid, which could be the result of
intentional tampering.
So check params.key_size explicitly against the size of the target buffer
before validating the key further.
Fixes: 17858b140bf4 ("crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()")
Reported-by: Pavel Machek <[email protected]>
Cc: <[email protected]>
Signed-off-by: Ard Biesheuvel <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
Diffstat (limited to 'fs/btrfs/dev-replace.c')
0 files changed, 0 insertions, 0 deletions