redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

eCryptfs: fix Tag 11 parsing code 

Fix up the Tag 11 parsing code to handle size limits and boundaries more
explicitly.  Pay attention to *8* bytes for the key identifier (literal data),
no more, no less.

Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
hifive-unleashed-5.1
Michael Halcrow 2007-10-16 01:27:57 -07:00 committed by Linus Torvalds
parent c59becfcee
commit f648104a0d
1 changed files with 29 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
fs/ecryptfs/keystore.c
View File

@ -803,82 +803,60 @@ parse_tag_11_packet(unsigned char *data, unsigned char *contents,
(*packet_size) = 0;
(*tag_11_contents_size) = 0;
/* check that:
* one byte for the Tag 11 ID flag
* two bytes for the Tag 11 length
* do not exceed the maximum_packet_size
/* This format is inspired by OpenPGP; see RFC 2440
* packet tag 11
*
* Tag 11 identifier (1 byte)
* Max Tag 11 packet size (max 3 bytes)
* Binary format specifier (1 byte)
* Filename length (1 byte)
* Filename ("_CONSOLE") (8 bytes)
* Modification date (4 bytes)
* Literal data (arbitrary)
*
* We need at least 16 bytes of data for the packet to even be
* valid.
*/
if (unlikely((*packet_size) + 3 > max_packet_size)) {
ecryptfs_printk(KERN_ERR, "Packet size exceeds max\n");
if (max_packet_size < 16) {
printk(KERN_ERR "Maximum packet size too small\n");
rc = -EINVAL;
goto out;
}
/* check for Tag 11 identifyer - one byte */
if (data[(*packet_size)++] != ECRYPTFS_TAG_11_PACKET_TYPE) {
ecryptfs_printk(KERN_WARNING,
"Invalid tag 11 packet format\n");
printk(KERN_WARNING "Invalid tag 11 packet format\n");
rc = -EINVAL;
goto out;
}
/* get Tag 11 content length - one or two bytes */
rc = parse_packet_length(&data[(*packet_size)], &body_size,
&length_size);
if (rc) {
ecryptfs_printk(KERN_WARNING,
"Invalid tag 11 packet format\n");
if ((rc = parse_packet_length(&data[(*packet_size)], &body_size,
&length_size))) {
printk(KERN_WARNING "Invalid tag 11 packet format\n");
goto out;
}
if (body_size < 14) {
printk(KERN_WARNING "Invalid body size ([%d])\n", body_size);
rc = -EINVAL;
goto out;
}
(*packet_size) += length_size;
if (body_size < 13) {
ecryptfs_printk(KERN_WARNING, "Invalid body size ([%d])\n",
body_size);
rc = -EINVAL;
goto out;
}
/* We have 13 bytes of surrounding packet values */
(*tag_11_contents_size) = (body_size - 13);
/* now we know the length of the remainting Tag 11 packet size:
* 14 fix bytes for: special flag one, special flag two,
* 12 skipped bytes
* body_size bytes minus the stuff above is the Tag 11 content
*/
/* FIXME why is the body size one byte smaller than the actual
* size of the body?
* this seems to be an error here as well as in
* write_tag_11_packet() */
(*tag_11_contents_size) = (body_size - 14);
if (unlikely((*packet_size) + body_size + 1 > max_packet_size)) {
ecryptfs_printk(KERN_ERR, "Packet size exceeds max\n");
printk(KERN_ERR "Packet size exceeds max\n");
rc = -EINVAL;
goto out;
}
/* special flag one - one byte */
if (data[(*packet_size)++] != 0x62) {
ecryptfs_printk(KERN_WARNING, "Unrecognizable packet\n");
printk(KERN_WARNING "Unrecognizable packet\n");
rc = -EINVAL;
goto out;
}
/* special flag two - one byte */
if (data[(*packet_size)++] != 0x08) {
ecryptfs_printk(KERN_WARNING, "Unrecognizable packet\n");
printk(KERN_WARNING "Unrecognizable packet\n");
rc = -EINVAL;
goto out;
}
/* skip the next 12 bytes */
(*packet_size) += 12; /* We don't care about the filename or
* the timestamp */
/* get the Tag 11 contents - tag_11_contents_size bytes */
(*packet_size) += 12; /* Ignore filename and modification date */
memcpy(contents, &data[(*packet_size)], (*tag_11_contents_size));
(*packet_size) += (*tag_11_contents_size);
out:
if (rc) {
(*packet_size) = 0;