Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fa6dd8a2 authored by Nicolas Dichtel's avatar Nicolas Dichtel Committed by David S. Miller
Browse files

xfrm: check trunc_len in XFRMA_ALG_AUTH_TRUNC 



Maximum trunc length is defined by MAX_AH_AUTH_LEN (in bytes)
and need to be checked when this value is set (in bits) by
the user. In ah4.c and ah6.c a BUG_ON() checks this condiftion.

Signed-off-by: default avatarNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f76957fc

net/xfrm/xfrm_user.c

+3 −1
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#include <net/sock.h>

#include <net/xfrm.h>

#include <net/netlink.h>

#include <net/ah.h>

#include <asm/uaccess.h>

#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)

#include <linux/in6.h>
@@ -302,7 +303,8 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props, 
	algo = xfrm_aalg_get_byname(ualg->alg_name, 1);

	if (!algo)

		return -ENOSYS;

	if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)

	if ((ualg->alg_trunc_len / 8) > MAX_AH_AUTH_LEN ||

	    ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits)

		return -EINVAL;

	*props = algo->desc.sadb_alg_id;