From: Thomas Egerer <thomas.egerer@secunet.com>
Date: Tue, 31 May 2016 15:30:03 +0000 (+0200)
Subject: xfrm: check length of alg_name before strcpying it
X-Git-Tag: libnl3_2_28rc1~8^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=bd3791dcf3eb1934a87b151da9af9c4e6086928d;p=libnl

xfrm: check length of alg_name before strcpying it

If the parameter alg_name points to a string longer then what libnl
accepts as alg_name, the call to strcpy may write far beyond the
particular data structure.
Instead of truncating the string (using strncpy) this patch adds a check
and returns -1 for strings being longer than 63 bytes.

Signed-off-by: Thomas Egerer <thomas.egerer@secunet.com>
Signed-off-by: Thomas Haller <thaller@redhat.com>

Fixes: 917154470895520a77f527343f3a0cc1605934b0

http://lists.infradead.org/pipermail/libnl/2016-May/002133.html
---

diff --git a/lib/xfrm/sa.c b/lib/xfrm/sa.c
index 69bcfd6..1cd6edd 100644
--- a/lib/xfrm/sa.c
+++ b/lib/xfrm/sa.c
@@ -1635,7 +1635,7 @@ int xfrmnl_sa_set_aead_params (struct xfrmnl_sa* sa, char* alg_name, unsigned in
 	/* Free up the old key and allocate memory to hold new key */
 	if (sa->aead)
 		free (sa->aead);
-	if ((sa->aead = calloc (1, newlen)) == NULL)
+	if (strlen (alg_name) >= sizeof (sa->aead->alg_name) || (sa->aead = calloc (1, newlen)) == NULL)
 		return -1;
 
 	/* Save the new info */
@@ -1672,7 +1672,7 @@ int xfrmnl_sa_set_auth_params (struct xfrmnl_sa* sa, char* alg_name, unsigned in
 	/* Free up the old auth data and allocate new one */
 	if (sa->auth)
 		free (sa->auth);
-	if ((sa->auth = calloc (1, newlen)) == NULL)
+	if (strlen (alg_name) >= sizeof (sa->auth->alg_name) || (sa->auth = calloc (1, newlen)) == NULL)
 		return -1;
 
 	/* Save the new info */
@@ -1708,7 +1708,7 @@ int xfrmnl_sa_set_crypto_params (struct xfrmnl_sa* sa, char* alg_name, unsigned
 	/* Free up the old crypto and allocate new one */
 	if (sa->crypt)
 		free (sa->crypt);
-	if ((sa->crypt = calloc (1, newlen)) == NULL)
+	if (strlen (alg_name) >= sizeof (sa->crypt->alg_name) || (sa->crypt = calloc (1, newlen)) == NULL)
 		return -1;
 
 	/* Save the new info */
@@ -1743,7 +1743,7 @@ int xfrmnl_sa_set_comp_params (struct xfrmnl_sa* sa, char* alg_name, unsigned in
 	/* Free up the old compression algo params and allocate new one */
 	if (sa->comp)
 		free (sa->comp);
-	if ((sa->comp = calloc (1, newlen)) == NULL)
+	if (strlen (alg_name) >= sizeof (sa->comp->alg_name) || (sa->comp = calloc (1, newlen)) == NULL)
 		return -1;
 
 	/* Save the new info */