eCryptfs: Allocate sufficient buffer space for encrypted filename decoding
PATCH 1/1 eCryptfs: Allocate sufficient buffer space for encrypted filename decoding
Dmitry Chernenkov used KASAN to discover that eCryptfs writes past the end of the allocated buffer during encrypted filename decoding. This fix corrects the issue by ensuring that there is sufficient buffer space allocated.
--- fs/ecryptfs/crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ecryptfs/crypto.c +1 -1
@@ -1871,7 +1871,7 @@ static size_t ecryptfs_max_decoded_size(size_t encoded_size)* the caller with the maximum amount of allocated * space that @dst will need to point to in a * subsequent call. */ -return ((encoded_size +1 ) *3 ) /4 ; +return (((encoded_size +1 ) *3 ) /4 ) +1 ; }/**
Signature · 1 line
2.1.0.rc2.206.gedb03e5
Quoted 15 lines · Michael Halcrow
Dmitry Chernenkov used KASAN to discover that eCryptfs writes past the end of the allocated buffer during encrypted filename decoding. This fix corrects the issue by ensuring that there is sufficient buffer space allocated.
Signed-off-by Michael Halcrow <[email protected]>--- fs/ecryptfs/crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)fs/ecryptfs/crypto.c +0
-0
fs/ecryptfs/crypto.c static size_t ecryptfs_max_decoded_size(size_t encoded_size) · line 1874
Quoted 5 lines
fs/ecryptfs/crypto.c +1
-1@@ -1871,7 +1871,7 @@ static size_t ecryptfs_max_decoded_size(size_t encoded_size)* the caller with the maximum amount of allocated * space that @dst will need to point to in a * subsequent call. */ -return ((encoded_size +1 ) *3 ) /4 ; +return (((encoded_size +1 ) *3 ) /4 ) +1 ;
Kees pointed out that the last write of 0 isn't even necessary.
Ignore this patch. I've sent out a fix that removes that write.
Quoted 6 lines
fs/ecryptfs/crypto.c +0
-1}/** -- 2.1.0.rc2.206.gedb03e5
Quoted 24 lines · Michael Halcrow
Quoted 15 lines · Michael Halcrow
Dmitry Chernenkov used KASAN to discover that eCryptfs writes past the end of the allocated buffer during encrypted filename decoding. This fix corrects the issue by ensuring that there is sufficient buffer space allocated.
Signed-off-by Michael Halcrow <[email protected]>--- fs/ecryptfs/crypto.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)fs/ecryptfs/crypto.c +0
-0fs/ecryptfs/crypto.c static size_t ecryptfs_max_decoded_size(size_t encoded_size) · line 1874
Quoted 5 lines
fs/ecryptfs/crypto.c +1
-1@@ -1871,7 +1871,7 @@ static size_t ecryptfs_max_decoded_size(size_t encoded_size)* the caller with the maximum amount of allocated * space that @dst will need to point to in a * subsequent call. */ -return ((encoded_size +1 ) *3 ) /4 ; +return (((encoded_size +1 ) *3 ) /4 ) +1 ;Kees pointed out that the last write of 0 isn't even necessary.
Quoted 1 line
Ignore this patch. I've sent out a fix that removes that write.
Agreed. I had been looking into this today and was about to say the same thing. Thanks!
Tyler
Quoted 11 lines
Quoted 7 lines
fs/ecryptfs/crypto.c +0
-1}/** -- 2.1.0.rc2.206.gedb03e5
--
To unsubscribe from this list: send the line "unsubscribe ecryptfs" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html