* [PATCH] crypto: avoid negative wrapping of integers
@ 2021-07-26 16:45 Jordy Zomer
0 siblings, 0 replies; only message in thread
From: Jordy Zomer @ 2021-07-26 16:45 UTC (permalink / raw)
Cc: Greg Kroah-Hartman, Jordy Zomer, Herbert Xu, David S. Miller,
linux-crypto, linux-kernel
Set csize to unsigned int to avoid it from wrapping as a negative number (since format input sends an unsigned integer to this function). This would also result in undefined behavior in the left shift when msg len is checked, potentially resulting in a buffer overflow in the memcpy call.
Signed-off-by: Jordy Zomer <jordy@pwning.systems>
---
crypto/ccm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/crypto/ccm.c b/crypto/ccm.c
index 6b815ece51c6..e14201edf9db 100644
--- a/crypto/ccm.c
+++ b/crypto/ccm.c
@@ -66,7 +66,7 @@ static inline struct crypto_ccm_req_priv_ctx *crypto_ccm_reqctx(
return (void *)PTR_ALIGN((u8 *)aead_request_ctx(req), align + 1);
}
-static int set_msg_len(u8 *block, unsigned int msglen, int csize)
+static int set_msg_len(u8 *block, unsigned int msglen, unsigned int csize)
{
__be32 data;
--
2.27.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2021-07-26 16:58 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-26 16:45 [PATCH] crypto: avoid negative wrapping of integers Jordy Zomer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).