Re: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
From: Herbert Xu <herbert@gondor.apana.org.au>
Date: 2023-01-06 15:19:30
Also in:
keyrings, linux-crypto, linux-integrity, lkml, stable
On Tue, Dec 27, 2022 at 03:27:39PM +0100, Roberto Sassu wrote:
From: Herbert Xu <herbert@gondor.apana.org.au>
The helper mpi_read_raw_from_sgl sets the number of entries in
the SG list according to nbytes. However, if the last entry
in the SG list contains more data than nbytes, then it may overrun
the buffer because it only allocates enough memory for nbytes.
Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
Reported-by: Roberto Sassu <redacted>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---
lib/mpi/mpicoder.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)Patch applied. Thanks. -- Email: Herbert Xu [off-list ref] Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt