Herbert Xu 463dbc99d9 lib/mpi: Fix buffer overrun when SG is too long ... [ Upstream commit 7361d1bc30 ] The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes. Fixes: 2d4d1eea54 ("lib/mpi: Add mpi sgl helpers") Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-03-11 16:31:35 +01:00
..
generic_mpih-add1.c
generic_mpih-lshift.c
generic_mpih-mul1.c
generic_mpih-mul2.c
generic_mpih-mul3.c
generic_mpih-rshift.c
generic_mpih-sub1.c
longlong.h	lib/mpi: Fix 64-bit MIPS build with Clang	2020-06-22 09:05:14 +02:00
Makefile
mpi-bit.c
mpi-cmp.c
mpi-inline.h
mpi-internal.h
mpi-pow.c	lib/mpi: Fix karactx leak in mpi_powm	2019-07-10 09:53:42 +02:00
mpicoder.c	lib/mpi: Fix buffer overrun when SG is too long	2023-03-11 16:31:35 +01:00
mpih-cmp.c
mpih-div.c
mpih-mul.c
mpiutil.c	lib/mpi: use kcalloc in mpi_resize	2021-09-22 11:47:51 +02:00