OSDN Git Service

(root) / tomoyo / tomoyo-test1.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: c65d9df) | patch
SUNRPC: Fix crasher in unwrap_integ_data()
authorChuck Lever <chuck.lever@oracle.com>
Sun, 27 Nov 2022 17:17:27 +0000 (12:17 -0500)
committerChuck Lever <cel@kernel.org>
Sat, 10 Dec 2022 16:01:13 +0000 (11:01 -0500)
commit4dd9daa9124aad3c3d4ceca4f1d417cc62d59156
tree8303c8dad42987d5a6c978df4bd0e587f629587ftree | snapshot
parentc65d9df0c4a0e150d97aff363cbd0363f21f9466commit | diff
SUNRPC: Fix crasher in unwrap_integ_data()

If a zero length is passed to kmalloc() it returns 0x10, which is
not a valid address. gss_verify_mic() subsequently crashes when it
attempts to dereference that pointer.

Instead of allocating this memory on every call based on an
untrusted size value, use a piece of dynamically-allocated scratch
memory that is always available.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
net/sunrpc/auth_gss/svcauth_gss.c diff | blob | history
This is a test repository.
About OSDN
Find Software
Develop Software
Help