Kevin Easton 4b66af2d63 af_key: Always verify length of provided sadb_key ... Key extensions (struct sadb_key) include a user-specified number of key bits. The kernel uses that number to determine how much key data to copy out of the message in pfkey_msg2xfrm_state(). The length of the sadb_key message must be verified to be long enough, even in the case of SADB_X_AALG_NULL. Furthermore, the sadb_key_len value must be long enough to include both the key data and the struct sadb_key itself. Introduce a helper function verify_key_len(), and call it from parse_exthdrs() where other exthdr types are similarly checked for correctness. Signed-off-by: Kevin Easton <kevin@guarana.org> Reported-by: syzbot+5022a34ca5a3d49b84223653fab632dfb7b4cf37@syzkaller.appspotmail.com Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>		2018-04-09 07:06:38 +02:00
..
af_key.c	af_key: Always verify length of provided sadb_key	2018-04-09 07:06:38 +02:00
Makefile	Linux-2.6.12-rc2	2005-04-16 15:20:36 -07:00