浏览代码

Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  [CRYPTO] api: fix writting into unallocated memory in setkey_aligned
Linus Torvalds 18 年之前
父节点
当前提交
f27eb3afe8
共有 4 个文件被更改,包括 4 次插入4 次删除
  1. 1 1
      crypto/ablkcipher.c
  2. 1 1
      crypto/blkcipher.c
  3. 1 1
      crypto/cipher.c
  4. 1 1
      crypto/hash.c

+ 1 - 1
crypto/ablkcipher.c

@@ -35,7 +35,7 @@ static int setkey_unaligned(struct crypto_ablkcipher *tfm, const u8 *key, unsign
 	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
 	memcpy(alignbuffer, key, keylen);
 	ret = cipher->setkey(tfm, alignbuffer, keylen);
-	memset(alignbuffer, 0, absize);
+	memset(alignbuffer, 0, keylen);
 	kfree(buffer);
 	return ret;
 }

+ 1 - 1
crypto/blkcipher.c

@@ -352,7 +352,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, unsigned int
 	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
 	memcpy(alignbuffer, key, keylen);
 	ret = cipher->setkey(tfm, alignbuffer, keylen);
-	memset(alignbuffer, 0, absize);
+	memset(alignbuffer, 0, keylen);
 	kfree(buffer);
 	return ret;
 }

+ 1 - 1
crypto/cipher.c

@@ -36,7 +36,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key, unsigned int
 	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
 	memcpy(alignbuffer, key, keylen);
 	ret = cia->cia_setkey(tfm, alignbuffer, keylen);
-	memset(alignbuffer, 0, absize);
+	memset(alignbuffer, 0, keylen);
 	kfree(buffer);
 	return ret;
 

+ 1 - 1
crypto/hash.c

@@ -40,7 +40,7 @@ static int hash_setkey_unaligned(struct crypto_hash *crt, const u8 *key,
 	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
 	memcpy(alignbuffer, key, keylen);
 	ret = alg->setkey(crt, alignbuffer, keylen);
-	memset(alignbuffer, 0, absize);
+	memset(alignbuffer, 0, keylen);
 	kfree(buffer);
 	return ret;
 }