Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-04 12:16:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

eCryptfs: fix Tag 11 parsing code

Browse Source 
Fix up the Tag 11 parsing code to handle size limits and boundaries more
explicitly.  Pay attention to *8* bytes for the key identifier (literal data),
no more, no less.

Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Michael Halcrow 2007-10-16 01:27:57 -07:00 committed by Linus Torvalds
parent c59becfcee
commit f648104a0d
1 changed files with 29 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
fs/ecryptfs/keystore.c
View File

@ -803,82 +803,60 @@ parse_tag_11_packet(unsigned char *data, unsigned char *contents,
(*packet_size) = 0; (*packet_size) = 0;
(*tag_11_contents_size) = 0; (*tag_11_contents_size) = 0;
/* This format is inspired by OpenPGP; see RFC 2440
/* check that: * packet tag 11
* one byte for the Tag 11 ID flag *
* two bytes for the Tag 11 length * Tag 11 identifier (1 byte)
* do not exceed the maximum_packet_size * Max Tag 11 packet size (max 3 bytes)
* Binary format specifier (1 byte)
* Filename length (1 byte)
* Filename ("_CONSOLE") (8 bytes)
* Modification date (4 bytes)
* Literal data (arbitrary)
*
* We need at least 16 bytes of data for the packet to even be
* valid.
*/ */
if (unlikely((*packet_size) + 3 > max_packet_size)) { if (max_packet_size < 16) {
ecryptfs_printk(KERN_ERR, "Packet size exceeds max\n"); printk(KERN_ERR "Maximum packet size too small\n");
rc = -EINVAL; rc = -EINVAL;
goto out; goto out;
} }
/* check for Tag 11 identifyer - one byte */
if (data[(*packet_size)++] != ECRYPTFS_TAG_11_PACKET_TYPE) { if (data[(*packet_size)++] != ECRYPTFS_TAG_11_PACKET_TYPE) {
ecryptfs_printk(KERN_WARNING, printk(KERN_WARNING "Invalid tag 11 packet format\n");
"Invalid tag 11 packet format\n");
rc = -EINVAL; rc = -EINVAL;
goto out; goto out;
} }
if ((rc = parse_packet_length(&data[(*packet_size)], &body_size,
/* get Tag 11 content length - one or two bytes */ &length_size))) {
rc = parse_packet_length(&data[(*packet_size)], &body_size, printk(KERN_WARNING "Invalid tag 11 packet format\n");
&length_size); goto out;
if (rc) { }
ecryptfs_printk(KERN_WARNING, if (body_size < 14) {
"Invalid tag 11 packet format\n"); printk(KERN_WARNING "Invalid body size ([%d])\n", body_size);
rc = -EINVAL;
goto out; goto out;
} }
(*packet_size) += length_size; (*packet_size) += length_size;
(*tag_11_contents_size) = (body_size - 14);
if (body_size < 13) {
ecryptfs_printk(KERN_WARNING, "Invalid body size ([%d])\n",
body_size);
rc = -EINVAL;
goto out;
}
/* We have 13 bytes of surrounding packet values */
(*tag_11_contents_size) = (body_size - 13);
/* now we know the length of the remainting Tag 11 packet size:
* 14 fix bytes for: special flag one, special flag two,
* 12 skipped bytes
* body_size bytes minus the stuff above is the Tag 11 content
*/
/* FIXME why is the body size one byte smaller than the actual
* size of the body?
* this seems to be an error here as well as in
* write_tag_11_packet() */
if (unlikely((*packet_size) + body_size + 1 > max_packet_size)) { if (unlikely((*packet_size) + body_size + 1 > max_packet_size)) {
ecryptfs_printk(KERN_ERR, "Packet size exceeds max\n"); printk(KERN_ERR "Packet size exceeds max\n");
rc = -EINVAL; rc = -EINVAL;
goto out; goto out;
} }
/* special flag one - one byte */
if (data[(*packet_size)++] != 0x62) { if (data[(*packet_size)++] != 0x62) {
ecryptfs_printk(KERN_WARNING, "Unrecognizable packet\n"); printk(KERN_WARNING "Unrecognizable packet\n");
rc = -EINVAL; rc = -EINVAL;
goto out; goto out;
} }
/* special flag two - one byte */
if (data[(*packet_size)++] != 0x08) { if (data[(*packet_size)++] != 0x08) {
ecryptfs_printk(KERN_WARNING, "Unrecognizable packet\n"); printk(KERN_WARNING "Unrecognizable packet\n");
rc = -EINVAL; rc = -EINVAL;
goto out; goto out;
} }
(*packet_size) += 12; /* Ignore filename and modification date */
/* skip the next 12 bytes */
(*packet_size) += 12; /* We don't care about the filename or
* the timestamp */
/* get the Tag 11 contents - tag_11_contents_size bytes */
memcpy(contents, &data[(*packet_size)], (*tag_11_contents_size)); memcpy(contents, &data[(*packet_size)], (*tag_11_contents_size));
(*packet_size) += (*tag_11_contents_size); (*packet_size) += (*tag_11_contents_size);
out: out:
if (rc) { if (rc) {
(*packet_size) = 0; (*packet_size) = 0;