diff options
| author | Kevin Easton <kevin@guarana.org> | 2018-04-07 18:40:33 +0300 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2018-04-09 08:06:38 +0300 |
| commit | 4b66af2d6356a00e94bcdea3e7fea324e8b5c6f4 (patch) | |
| tree | 3efe012a7d80247996cbca68eff8aca7894853c5 /net/xfrm | |
| parent | 76327a35caabd1a932e83d6a42b967aa08584e5d (diff) | |
| download | linux-4b66af2d6356a00e94bcdea3e7fea324e8b5c6f4.tar.xz | |
af_key: Always verify length of provided sadb_key
Key extensions (struct sadb_key) include a user-specified number of key
bits. The kernel uses that number to determine how much key data to copy
out of the message in pfkey_msg2xfrm_state().
The length of the sadb_key message must be verified to be long enough,
even in the case of SADB_X_AALG_NULL. Furthermore, the sadb_key_len value
must be long enough to include both the key data and the struct sadb_key
itself.
Introduce a helper function verify_key_len(), and call it from
parse_exthdrs() where other exthdr types are similarly checked for
correctness.
Signed-off-by: Kevin Easton <kevin@guarana.org>
Reported-by: syzbot+5022a34ca5a3d49b84223653fab632dfb7b4cf37@syzkaller.appspotmail.com
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/xfrm')
0 files changed, 0 insertions, 0 deletions