Attachment 49017 Details for Bug 115200

[patch] ipsec-crash-bug115200.patch

ipsec-crash-bug115200.patch (text/plain), 1.64 KB, created by Olaf Hering on 2005-09-07 07:48:59 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Olaf Hering

Created: 2005-09-07 07:48:59 UTC

Size: 1.64 KB

patch

obsolete

>From: herbert@gondor.apana.org.au
>Subject: Bug 115200 - IPsec crashes kernel
>
>[CRYPTO] Fix boundary check in standard multi-block cipher processors
>
>The boundary check in the standard multi-block cipher processors are
>broken when nbytes is not a multiple of bsize.  In those cases it will
>always process an extra block.
>
>This patch corrects the check so that it processes at most nbytes of data.
>
>Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
>Signed-off-by: Olaf Hering <olh@suse.de>
>
>diff --git a/crypto/cipher.c b/crypto/cipher.c
>--- a/crypto/cipher.c
>+++ b/crypto/cipher.c
>@@ -191,6 +191,8 @@ static unsigned int cbc_process_encrypt(
> 	u8 *iv = desc->info;
> 	unsigned int done = 0;
> 
>+	nbytes -= bsize;
>+
> 	do {
> 		xor(iv, src);
> 		fn(crypto_tfm_ctx(tfm), dst, iv);
>@@ -198,7 +200,7 @@ static unsigned int cbc_process_encrypt(
> 
> 		src += bsize;
> 		dst += bsize;
>-	} while ((done += bsize) < nbytes);
>+	} while ((done += bsize) <= nbytes);
> 
> 	return done;
> }
>@@ -219,6 +221,8 @@ static unsigned int cbc_process_decrypt(
> 	u8 *iv = desc->info;
> 	unsigned int done = 0;
> 
>+	nbytes -= bsize;
>+
> 	do {
> 		u8 *tmp_dst = *dst_p;
> 
>@@ -230,7 +234,7 @@ static unsigned int cbc_process_decrypt(
> 
> 		src += bsize;
> 		dst += bsize;
>-	} while ((done += bsize) < nbytes);
>+	} while ((done += bsize) <= nbytes);
> 
> 	return done;
> }
>@@ -243,12 +247,14 @@ static unsigned int ecb_process(const st
> 	void (*fn)(void *, u8 *, const u8 *) = desc->crfn;
> 	unsigned int done = 0;
> 
>+	nbytes -= bsize;
>+
> 	do {
> 		fn(crypto_tfm_ctx(tfm), dst, src);
> 
> 		src += bsize;
> 		dst += bsize;
>-	} while ((done += bsize) < nbytes);
>+	} while ((done += bsize) <= nbytes);
> 
> 	return done;
> }

Actions: View | Diff

Attachments on bug 115200: 48814 | 48858 | 49008 | 49017 | 49085