mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete()
commita24611ea35
upstream. Before checking whether the expected digest_info is present, we need to check that there are enough bytes remaining. Fixes:a49de377e0
("crypto: Add hash param to pkcs1pad") Cc: <stable@vger.kernel.org> # v4.6+ Cc: Tadeusz Struk <tadeusz.struk@linaro.org> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
058b2e59db
commit
baa4aa800d
1 changed files with 2 additions and 0 deletions
|
@ -475,6 +475,8 @@ static int pkcs1pad_verify_complete(struct akcipher_request *req, int err)
|
|||
pos++;
|
||||
|
||||
if (digest_info) {
|
||||
if (digest_info->size > dst_len - pos)
|
||||
goto done;
|
||||
if (crypto_memneq(out_buf + pos, digest_info->data,
|
||||
digest_info->size))
|
||||
goto done;
|
||||
|
|
Loading…
Reference in a new issue