From patchwork Tue Mar 22 12:12:42 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nicolai Stange X-Patchwork-Id: 8641911 X-Patchwork-Delegate: herbert@gondor.apana.org.au Return-Path: X-Original-To: patchwork-linux-crypto@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 0677A9F294 for ; Tue, 22 Mar 2016 12:16:39 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 0E45F202FE for ; Tue, 22 Mar 2016 12:16:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 24B372035B for ; Tue, 22 Mar 2016 12:16:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758995AbcCVMQd (ORCPT ); Tue, 22 Mar 2016 08:16:33 -0400 Received: from mail-wm0-f65.google.com ([74.125.82.65]:35903 "EHLO mail-wm0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758354AbcCVMOH (ORCPT ); Tue, 22 Mar 2016 08:14:07 -0400 Received: by mail-wm0-f65.google.com with SMTP id l68so29153601wml.3; Tue, 22 Mar 2016 05:14:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=qVW6wFtuzRLw49iJY8LmE+t933EATmHFujfwqidhq6c=; b=wogwvxpvvWA7hOBILTyYCl1vnxfs1lMCoKpdzZT9LfgGaDx+6cwu0YD488i3UsDEqU 9WYFAdZD7AUKMm/LG4MgCmpjdbaoudmaAMTnAMVjx9EPi6ShMtuhE5fyGOpjkABduSVs rqqkqPXlpBkqejH7FSa8c3468QjYatXrzhulICDbDGuyOkfW/m76Jl9cDI6RCDgypBJw S4jx0K3DvyHp86TlbrtM2BqFdjyx7Vt+UaLPs11Ge5dvgkWnVNWziXkBwSOoQpMe3aAQ SsLnYd0+UxiO18cCyg7TINFOnnhS68dumzoRI5c8b5PvlKDpisaRPJrg8GKy076XIC3p zyxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=qVW6wFtuzRLw49iJY8LmE+t933EATmHFujfwqidhq6c=; b=FFZbETSE6VSrTeFyIMFnxccFRu6kC1gBxf3ahHmsoY284QXlOWxBCNdmNDcIqaXFr2 MsYixiAwdyI4k3CaYBGXH01TUXt6xth+CpsPt6uLapScpnBP7Qge2IqL+aFPgtwEdgGB BlKFzXg3DDI9jxkvXzaYmaguQsYafmxzNtFZcic7FIqBGcqCKSF8apsKxd404IcWyZdo 8o+toxrYdBXFrTejqZG7kWtfrFoMiRKg8UvS56IlRhpP9ISmdbgcR3yNPq29CDNSr0Vf cvWmc0Waqa2oKQhfAaipR1UUuENM81FCK+IWN/J3e7E82PpMDItZhHFBFcDh0XN4kR/g STnQ== X-Gm-Message-State: AD7BkJLeKFjKvMfd4ycRLZjcOe3S28XQVB5eeSGFnwdSL41b6Bb5aJkuNlUsVDNzt3lzew== X-Received: by 10.28.150.4 with SMTP id y4mr18896324wmd.43.1458648845987; Tue, 22 Mar 2016 05:14:05 -0700 (PDT) Received: from localhost (x55b18fc0.dyn.telefonica.de. [85.177.143.192]) by smtp.gmail.com with ESMTPSA id z127sm17048025wme.5.2016.03.22.05.14.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 22 Mar 2016 05:14:05 -0700 (PDT) From: Nicolai Stange To: Herbert Xu , "David S. Miller" Cc: Tadeusz Struk , Michal Marek , Andrzej Zaborowski , Stephan Mueller , Arnd Bergmann , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, Nicolai Stange Subject: [PATCH v3 08/14] lib/mpi: mpi_read_buffer(): fix buffer overflow Date: Tue, 22 Mar 2016 13:12:42 +0100 Message-Id: <1458648768-1469-9-git-send-email-nicstange@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1458648768-1469-1-git-send-email-nicstange@gmail.com> References: <1458648768-1469-1-git-send-email-nicstange@gmail.com> Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Currently, mpi_read_buffer() writes full limbs to the output buffer and moves memory around to purge leading zero limbs afterwards. However, with commit 9cbe21d8f89d ("lib/mpi: only require buffers as big as needed for the integer") the caller is only required to provide a buffer large enough to hold the result without the leading zeros. This might result in a buffer overflow for small MP numbers with leading zeros. Fix this by coping the result to its final destination within the output buffer and not copying the leading zeros at all. Fixes: 9cbe21d8f89d ("lib/mpi: only require buffers as big as needed for the integer") Signed-off-by: Nicolai Stange --- lib/mpi/mpicoder.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c index a999ee1..d995a4c 100644 --- a/lib/mpi/mpicoder.c +++ b/lib/mpi/mpicoder.c @@ -201,16 +201,9 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes, #else #error please implement for this limb size. #endif - memcpy(p, &alimb, BYTES_PER_MPI_LIMB); - p += BYTES_PER_MPI_LIMB; - if (lzeros > 0) { - mpi_limb_t *limb1 = (void *)p - sizeof(alimb); - mpi_limb_t *limb2 = (void *)p - sizeof(alimb) - + lzeros; - *limb1 = *limb2; - p -= lzeros; - lzeros -= sizeof(alimb); - } + memcpy(p, (u8 *)&alimb + lzeros, BYTES_PER_MPI_LIMB - lzeros); + p += BYTES_PER_MPI_LIMB - lzeros; + lzeros = 0; } return 0; }