Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bb402c1e authored by Tanwee Kausar's avatar Tanwee Kausar
Browse files

crypto: Fix possible stack out of bound error 



Adding fix to check the upper limit on the length
of the destination array while copying elements from
source address to avoid stack out of bound error.

Change-Id: Ieb24e8f9b4a2b53fbc9442b25d790b12f737d471
Signed-off-by: default avatarTanwee Kausar <tkausar@codeaurora.org>
parent 803dd89d

drivers/crypto/msm/qce50.c

+6 −1
Original line number Original line Diff line number Diff line
@@ -2,7 +2,7 @@ 
/*

/*

 * QTI Crypto Engine driver.

 * QTI Crypto Engine driver.

 *

 *

 * Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.

 * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.

 */

 */





#define pr_fmt(fmt) "QCE50: %s: " fmt, __func__

#define pr_fmt(fmt) "QCE50: %s: " fmt, __func__
@@ -902,6 +902,11 @@ static int _ce_setup_cipher(struct qce_device *pce_dev, struct qce_req *creq, 
	switch (creq->alg) {

	switch (creq->alg) {

	case CIPHER_ALG_DES:

	case CIPHER_ALG_DES:

		if (creq->mode !=  QCE_MODE_ECB) {

		if (creq->mode !=  QCE_MODE_ECB) {

			if (ivsize > MAX_IV_LENGTH) {

				pr_err("%s: error: Invalid length parameter\n",

					 __func__);

				return -EINVAL;

			}

			_byte_stream_to_net_words(enciv32, creq->iv, ivsize);

			_byte_stream_to_net_words(enciv32, creq->iv, ivsize);

			pce = cmdlistinfo->encr_cntr_iv;

			pce = cmdlistinfo->encr_cntr_iv;

			pce->data = enciv32[0];

			pce->data = enciv32[0];