kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

libseckey: Fix possible out of bounds read in sk_ep11_parse_der_tag()

Browse Source 
For long-length field encoding, check if the number of length bytes
exceed the data size.

Assisted-by: IBM Bob:2.0.0
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2026-06-30 15:05:13 +02:00
committed by Jan Höppner
parent b4f575abc4
commit 634095aa24
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libseckey/sk_ep11.c
+2
View File
@@ -417,6 +417,8 @@ static unsigned char sk_ep11_parse_der_tag(const unsigned char *data,
if (num > sizeof(size_t))
return 0;
*value_len = data[2];
if (data_len < 2 + num)
return 0;
for (i = 1; i < num; i++) {
*value_len <<= 8;
*value_len |= data[2 + i];