From 35f7d5225ffcbf1b759f641aec1735e3a89b1914 Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Fri, 27 Jul 2018 15:36:10 -0700 Subject: crypto: dh - fix calculating encoded key size It was forgotten to increase DH_KPP_SECRET_MIN_SIZE to include 'q_size', causing an out-of-bounds write of 4 bytes in crypto_dh_encode_key(), and an out-of-bounds read of 4 bytes in crypto_dh_decode_key(). Fix it, and fix the lengths of the test vectors to match this. Reported-by: syzbot+6d38d558c25b53b8f4ed@syzkaller.appspotmail.com Fixes: e3fe0ae12962 ("crypto: dh - add public key verification test") Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu --- crypto/dh_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'crypto/dh_helper.c') diff --git a/crypto/dh_helper.c b/crypto/dh_helper.c index a7de3d9ce5ac..db9b2d9c58f0 100644 --- a/crypto/dh_helper.c +++ b/crypto/dh_helper.c @@ -14,7 +14,7 @@ #include #include -#define DH_KPP_SECRET_MIN_SIZE (sizeof(struct kpp_secret) + 3 * sizeof(int)) +#define DH_KPP_SECRET_MIN_SIZE (sizeof(struct kpp_secret) + 4 * sizeof(int)) static inline u8 *dh_pack_data(void *dst, const void *src, size_t size) { -- cgit v1.2.3