Module Name: src Committed By: riastradh Date: Fri Jul 28 14:16:29 UTC 2017
Modified Files: src/sys/opencrypto: ocryptodev.c Log Message: Avert userland-controlled integer overflow. >From Ilja Van Sprundel. To generate a diff of this commit: cvs rdiff -u -r1.9 -r1.10 src/sys/opencrypto/ocryptodev.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/opencrypto/ocryptodev.c diff -u src/sys/opencrypto/ocryptodev.c:1.9 src/sys/opencrypto/ocryptodev.c:1.10 --- src/sys/opencrypto/ocryptodev.c:1.9 Fri Jul 28 14:13:56 2017 +++ src/sys/opencrypto/ocryptodev.c Fri Jul 28 14:16:29 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: ocryptodev.c,v 1.9 2017/07/28 14:13:56 riastradh Exp $ */ +/* $NetBSD: ocryptodev.c,v 1.10 2017/07/28 14:16:29 riastradh Exp $ */ /* $FreeBSD: src/sys/opencrypto/cryptodev.c,v 1.4.2.4 2003/06/03 00:09:02 sam Exp $ */ /* $OpenBSD: cryptodev.c,v 1.53 2002/07/10 22:21:30 mickey Exp $ */ @@ -69,7 +69,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.9 2017/07/28 14:13:56 riastradh Exp $"); +__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.10 2017/07/28 14:16:29 riastradh Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -159,6 +159,11 @@ mbail: break; case OCIOCNCRYPTM: omop = (struct ocrypt_mop *)data; + if ((omop->count <= 0) || + (SIZE_MAX/sizeof(struct ocrypt_n_op) <= omop->count)) { + error = EINVAL; + break; + } ocnop = kmem_alloc((omop->count * sizeof(struct ocrypt_n_op)), KM_SLEEP); error = copyin(omop->reqs, ocnop,