matthias
/
iproute2
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

tipc: bail out if key is abnormally long 

tipc segfaults when called with an abnormally long key:

$ tipc node set key 0123456789abcdef0123456789abcdef0123456789abcdef
*** buffer overflow detected ***: terminated

Fix this returning an error if key length is longer than
TIPC_AEAD_KEYLEN_MAX.

Fixes: 24bee3bf97 ("tipc: add new commands to set TIPC AEAD key")
Signed-off-by: Andrea Claudi <aclaudi@redhat.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
This commit is contained in:
Andrea Claudi 2021-05-01 18:32:30 +02:00 committed by David Ahern
parent 93c267bfb4
commit 28ee49e515
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
tipc/misc.c
View File

@ -113,6 +113,9 @@ int str2key(char *str, struct tipc_aead_key *key)
} }
} }
if (len > TIPC_AEAD_KEYLEN_MAX)
return -1;
/* Obtain key: */ /* Obtain key: */
if (!ishex) { if (!ishex) {
key->keylen = len; key->keylen = len;