korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-27 14:14:24 +08:00
Code Issues Packages Projects Releases Wiki Activity

[IPSEC]: Fixed alg_key_len usage in attach_one_algo

Browse Source 
The variable alg_key_len is in bits and not bytes.  The function
attach_one_algo is currently using it as if it were in bytes.
This causes it to read memory which may not be there.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu 2005-05-19 12:39:04 -07:00 committed by David S. Miller
parent 8be58932ca
commit b9e9dead05
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/xfrm/xfrm_user.c
View File

@ -162,6 +162,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
struct rtattr *rta = u_arg; struct rtattr *rta = u_arg;
struct xfrm_algo *p, *ualg; struct xfrm_algo *p, *ualg;
struct xfrm_algo_desc *algo; struct xfrm_algo_desc *algo;
int len;
if (!rta) if (!rta)
return 0; return 0;
@ -173,11 +174,12 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
return -ENOSYS; return -ENOSYS;
*props = algo->desc.sadb_alg_id; *props = algo->desc.sadb_alg_id;
p = kmalloc(sizeof(*ualg) + ualg->alg_key_len, GFP_KERNEL); len = sizeof(*ualg) + (ualg->alg_key_len + 7U) / 8;
p = kmalloc(len, GFP_KERNEL);
if (!p) if (!p)
return -ENOMEM; return -ENOMEM;
memcpy(p, ualg, sizeof(*ualg) + ualg->alg_key_len); memcpy(p, ualg, len);
*algpp = p; *algpp = p;
return 0; return 0;
} }