From 610cc581da170433a31774da65ad27937f0f987d Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 9 Jun 2026 09:34:18 +0200 Subject: [PATCH] zkey: Fix file size checking in read_secure_key() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Key files read by read_secure_key() may not be just a key blob, but it might also contain an additional integrity key blob. Correct the upper bounds checking and allow up to 3 key blobs to be read. This allows for an AES-XTS key blob consisting of 2 key blobs plus an integrity key blob concatenated to the encryption key blob. Fixes: 771c79458073 ("zkey-cryptsetup: Support PHMAC integrity with setkey command") Reviewed-by: Finn Callies Signed-off-by: Ingo Franzki Signed-off-by: Jan Höppner --- zkey/pkey.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/zkey/pkey.c b/zkey/pkey.c index 76147a7d..18759191 100644 --- a/zkey/pkey.c +++ b/zkey/pkey.c @@ -100,7 +100,7 @@ u8 *read_secure_key(const char *keyfile, size_t *secure_key_size, } size = sb.st_size; - if (size < MIN_SECURE_KEY_SIZE || size > 2 * MAX_SECURE_KEY_SIZE) { + if (size < MIN_SECURE_KEY_SIZE || size > 3 * MAX_SECURE_KEY_SIZE) { warnx("File '%s' has an invalid size: %lu", keyfile, size); return NULL; }