diff options
| author | Aldo Ariel Panzardo <qwe.aldo@gmail.com> | 2026-09-25 14:58:39 -0300 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2026-10-02 18:12:44 +1000 |
| commit | b5c2df42977390a71f1940def5be9bd5c69ac2e0 (patch) | |
| tree | 8f70b7e8f70e88adda24702759fdb87a6bbeb59f | |
| parent | 7e7be8815143751c20260f80cb4e7fe14dd24b74 (diff) | |
crypto: nx - validate 'ignore' before subtracting in decompress
The decompress() function subtracts the header-supplied `ignore` value
(a u16 from the compressed stream) from `dlen` (the number of bytes
produced by the decompressor) without checking that ignore <= dlen.
If a caller decompresses a crafted buffer where `hdr->ignore` exceeds
the actual decompressed length, the subtraction wraps around to a
near-UINT_MAX value. The subsequent memcpy() then copies gigabytes of
data past the destination buffer, causing an out-of-bounds kernel write.
Add a bounds check before the subtraction and return -EINVAL if the
value is inconsistent.
Cc: stable@vger.kernel.org
Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
| -rw-r--r-- | drivers/crypto/nx/nx-842.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/crypto/nx/nx-842.c b/drivers/crypto/nx/nx-842.c index a61208cbcd27..b4404a138962 100644 --- a/drivers/crypto/nx/nx-842.c +++ b/drivers/crypto/nx/nx-842.c @@ -421,6 +421,8 @@ usesw: slen -= spadding; + if (ignore > dlen) + return -EINVAL; dlen -= ignore; if (ignore) pr_debug("ignoring last %x bytes\n", ignore); |