d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add stricter checking on mac key lengths.

Browse Source 
Negative lengths are always invalid.  The key length should also
be zero for hash algorithms that do not accept a key.

admbugs:	949
Reported by:	Yuval Kanarenstein <yuvalk@ssd-disclosure.com>
Reviewed by:	cem
MFC after:	1 week
Sponsored by:	Chelsio Communications
Differential Revision:	https://reviews.freebsd.org/D23094
This commit is contained in:
John Baldwin 2020-01-09 18:29:59 +00:00
parent dea247463c
commit 5ac518b51f
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=356561
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/opencrypto/cryptodev.c
View File

@ -585,8 +585,8 @@ cryptof_ioctl(
if (thash) {
cria.cri_alg = thash->type;
cria.cri_klen = sop->mackeylen * 8;
if (thash->keysize != 0 &&
sop->mackeylen > thash->keysize) {
if (sop->mackeylen > thash->keysize ||
sop->mackeylen < 0) {
CRYPTDEB("invalid mac key length");
error = EINVAL;
SDT_PROBE1(opencrypto, dev, ioctl, error,