Skip to content
Commit 457b6779 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Greg Kroah-Hartman
Browse files

crypto: ecdh - avoid buffer overflow in ecdh_set_secret()



commit 0aa171e9 upstream.

Pavel reports that commit 17858b14 ("crypto: ecdh - avoid unaligned
accesses in ecdh_set_secret()") fixes one problem but introduces another:
the unconditional memcpy() introduced by that commit may overflow the
target buffer if the source data is invalid, which could be the result of
intentional tampering.

So check params.key_size explicitly against the size of the target buffer
before validating the key further.

Fixes: 17858b14 ("crypto: ecdh - avoid unaligned accesses in ecdh_set_secret()")
Reported-by: default avatarPavel Machek <pavel@denx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarArd Biesheuvel <ardb@kernel.org>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9540ea23
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment