diff options
| author | kib <kib@FreeBSD.org> | 2007-10-08 20:08:34 +0000 |
|---|---|---|
| committer | kib <kib@FreeBSD.org> | 2007-10-08 20:08:34 +0000 |
| commit | 3c3bd88cdf6a99e63cca4d3e883e1c75f3639deb (patch) | |
| tree | 3826e32a5984f757d9e1328fbe423e3fcf0e449e /sys/opencrypto/cryptodev.c | |
| parent | 451b3404fce3fdd34fb76ddcdc59925fbd2d54b4 (diff) | |
| download | FreeBSD-src-3c3bd88cdf6a99e63cca4d3e883e1c75f3639deb.zip FreeBSD-src-3c3bd88cdf6a99e63cca4d3e883e1c75f3639deb.tar.gz | |
Deny attempt to malloc unbounded amount of the memory.
Convert malloc()/bzero() to malloc(M_ZERO).
Obtained from: OpenBSD
MFC after: 3 days
Approved by: re (kensmith)
Diffstat (limited to 'sys/opencrypto/cryptodev.c')
| -rw-r--r-- | sys/opencrypto/cryptodev.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/sys/opencrypto/cryptodev.c b/sys/opencrypto/cryptodev.c index 03071e0..a940a3c 100644 --- a/sys/opencrypto/cryptodev.c +++ b/sys/opencrypto/cryptodev.c @@ -590,10 +590,9 @@ cryptodev_key(struct crypt_kop *kop) return (EINVAL); } - krp = (struct cryptkop *)malloc(sizeof *krp, M_XDATA, M_WAITOK); + krp = (struct cryptkop *)malloc(sizeof *krp, M_XDATA, M_WAITOK|M_ZERO); if (!krp) return (ENOMEM); - bzero(krp, sizeof *krp); krp->krp_op = kop->crk_op; krp->krp_status = kop->crk_status; krp->krp_iparams = kop->crk_iparams; @@ -602,8 +601,12 @@ cryptodev_key(struct crypt_kop *kop) krp->krp_status = 0; krp->krp_callback = (int (*) (struct cryptkop *)) cryptodevkey_cb; - for (i = 0; i < CRK_MAXPARAM; i++) + for (i = 0; i < CRK_MAXPARAM; i++) { + if (kop->crk_param[i].crp_nbits > 65536) + /* Limit is the same as in OpenBSD */ + goto fail; krp->krp_param[i].crp_nbits = kop->crk_param[i].crp_nbits; + } for (i = 0; i < krp->krp_iparams + krp->krp_oparams; i++) { size = (krp->krp_param[i].crp_nbits + 7) / 8; if (size == 0) |
