The SM2 session setup path in openssl_set_asym_session_parameters()
copies the caller-supplied public key coordinates into a fixed 65-byte
stack buffer (1 byte uncompressed-point prefix + 32 bytes X + 32 bytes
Y) without first validating that the coordinate lengths fit.
Since xform->ec.q.x.length and xform->ec.q.y.length are generic size_t
values from the caller and are not bounds-checked before this point in
the driver, an oversized coordinate pair would overflow the pubkey[]
stack buffer before any OpenSSL API is reached.
Add a guard that rejects the xform when
1 + x.length + y.length > sizeof(pubkey), failing the session create
with the existing err_sm2 error path.
Fixes: b2fc11b6f8f1 ("crypto/openssl: support SM2 algorithm")
Cc: [email protected]
Signed-off-by: Kai Ji <[email protected]>
---
drivers/crypto/openssl/rte_openssl_pmd_ops.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
index 6133622f1b..4e5fb07bb2 100644
--- a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
+++ b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
@@ -1773,6 +1773,12 @@ static int openssl_set_asym_session_parameters(
goto err_sm2;
}
+ if (xform->ec.q.x.length >= sizeof(pubkey) ||
+ xform->ec.q.y.length >=
+ sizeof(pubkey) - xform->ec.q.x.length) {
+ OPENSSL_LOG(ERR, "SM2 public key coordinates too
large");
+ goto err_sm2;
+ }
memset(pubkey, 0, sizeof(pubkey));
pubkey[0] = 0x04;
len += 1;
--
2.43.0
