diff options
| author | Russell King <[email protected]> | 2015-10-09 19:43:38 +0000 |
|---|---|---|
| committer | Herbert Xu <[email protected]> | 2015-10-14 14:23:17 +0000 |
| commit | 9f5594c91e7cf5952ce39aff8b88c95a19a27e06 (patch) | |
| tree | 0e12730e589ac63e0a054779cb21a51fac5a5def /lib/mpi | |
| parent | MAINTAINERS: add maintainers for the Marvell Crypto driver (diff) | |
| download | kernel-9f5594c91e7cf5952ce39aff8b88c95a19a27e06.tar.gz kernel-9f5594c91e7cf5952ce39aff8b88c95a19a27e06.zip | |
crypto: marvell/cesa - fix stack smashing in marvell/hash.c
Several of the algorithms in marvell/hash.c have a statesize of zero.
When an AF_ALG accept() on an already-accepted file descriptor to
calls into hash_accept(), this causes:
char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))];
to be zero-sized, but we still pass this to:
err = crypto_ahash_export(req, state);
which proceeds to write to 'state' as if it was a "struct md5_state",
"struct sha1_state" etc. Add the necessary initialisers for the
.statesize member.
Acked-by: Boris Brezillon <[email protected]>
Signed-off-by: Russell King <[email protected]>
Signed-off-by: Herbert Xu <[email protected]>
Diffstat (limited to 'lib/mpi')
0 files changed, 0 insertions, 0 deletions
