Kernel
/
iwd
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git
3
0
Fork 0
Code Releases Activity

netdev: Check GTK / IGTK buffer length before memcpying from it 

Move key length checks in netdev_set_gtk/netdev_set_igtk to before we
memcpy from the buffer.
This commit is contained in:
Andrew Zaborowski 2017-01-31 03:42:54 +01:00 committed by Denis Kenzior
parent c033fcbf5e
commit 3a4887fef4
1 changed files with 14 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
src/netdev.c
View File

@ -795,6 +795,13 @@ static void netdev_set_gtk(uint32_t ifindex, uint8_t key_index,
l_debug("%d", netdev->index);
if (crypto_cipher_key_len(cipher) != gtk_len) {
l_error("Unexpected key length: %d", gtk_len);
netdev_setting_keys_failed(netdev,
MPDU_REASON_CODE_INVALID_GROUP_CIPHER);
return;
}
switch (cipher) {
case CRYPTO_CIPHER_CCMP:
memcpy(gtk_buf, gtk, 16);
@ -824,13 +831,6 @@ static void netdev_set_gtk(uint32_t ifindex, uint8_t key_index,
return;
}
if (crypto_cipher_key_len(cipher) != gtk_len) {
l_error("Unexpected key length: %d", gtk_len);
netdev_setting_keys_failed(netdev,
MPDU_REASON_CODE_INVALID_GROUP_CIPHER);
return;
}
msg = netdev_build_cmd_new_key_group(netdev, cipher, key_index,
gtk_buf, gtk_len,
rsc, rsc_len);
@ -858,6 +858,13 @@ static void netdev_set_igtk(uint32_t ifindex, uint8_t key_index,
l_debug("%d", netdev->index);
if (crypto_cipher_key_len(cipher) != igtk_len) {
l_error("Unexpected key length: %d", igtk_len);
netdev_setting_keys_failed(netdev,
MPDU_REASON_CODE_INVALID_GROUP_CIPHER);
return;
}
switch (cipher) {
case CRYPTO_CIPHER_BIP:
memcpy(igtk_buf, igtk, 16);
@ -869,13 +876,6 @@ static void netdev_set_igtk(uint32_t ifindex, uint8_t key_index,
return;
}
if (crypto_cipher_key_len(cipher) != igtk_len) {
l_error("Unexpected key length: %d", igtk_len);
netdev_setting_keys_failed(netdev,
MPDU_REASON_CODE_INVALID_GROUP_CIPHER);
return;
}
msg = netdev_build_cmd_new_key_group(netdev, cipher, key_index,
igtk_buf, igtk_len,
ipn, ipn_len);