diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2026-05-05 17:02:45 +0800 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2026-05-15 18:08:37 +0800 |
| commit | e4c06479d7059888adf2f22bc1ebcf053bf691a2 (patch) | |
| tree | 98011d210df843be07d1f0832f8d404803e62f13 /crypto | |
| parent | ffdd2bc378953b525aca61902534e753f1f8e734 (diff) | |
| download | lwn-e4c06479d7059888adf2f22bc1ebcf053bf691a2.tar.gz lwn-e4c06479d7059888adf2f22bc1ebcf053bf691a2.zip | |
crypto: af_alg - Cap AEAD AD length to 0x80000000
In order to prevent arithmetic overflows when checking the TX
buffer size, cap the associated data length to 0x80000000.
Reported-by: Yiming Qian <yimingqian591@gmail.com>
Fixes: 400c40cf78da ("crypto: algif - add AEAD support")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/af_alg.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/crypto/af_alg.c b/crypto/af_alg.c index fce0b87c2b65..48c53f488e0f 100644 --- a/crypto/af_alg.c +++ b/crypto/af_alg.c @@ -584,6 +584,8 @@ static int af_alg_cmsg_send(struct msghdr *msg, struct af_alg_control *con) if (cmsg->cmsg_len < CMSG_LEN(sizeof(u32))) return -EINVAL; con->aead_assoclen = *(u32 *)CMSG_DATA(cmsg); + if (con->aead_assoclen >= 0x80000000u) + return -EINVAL; break; default: |