From c7d0d3c1b94e29cf1ce6b37056ab43c23fe2e046 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 12:03:15 +0200 Subject: [PATCH] libkmipclient: Fix integer overflow in kmip_format_hex() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If length is >= 0x80000000 (2 GB), length * 2 wraps around to a small value, calloc allocates a too small buffer, then the loop writes length * 2 bytes into it causing a heap buffer overflow. Fix this by using a size_t for size calculation, and also checking the length before multiplication (needed on 32 bit platforms). Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libkmipclient/utils.c | 7 +++++-- libkmipclient/utils.h | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/libkmipclient/utils.c b/libkmipclient/utils.c index 0baf586c..fcbeeec7 100644 --- a/libkmipclient/utils.c +++ b/libkmipclient/utils.c @@ -166,13 +166,16 @@ int kmip_parse_hex(const char *str, bool has_prefix, unsigned char **val, * Format a hex string from the byte array specified in val. The caller must * free the returned str. */ -int kmip_format_hex(const unsigned char *val, uint32_t length, bool prefix, +int kmip_format_hex(const unsigned char *val, size_t length, bool prefix, char **str) { - uint32_t str_len, i; + size_t str_len, i; char tmp[4]; char *ret; + if (length > (SIZE_MAX - ((prefix ? 2 : 0) + 1)) / 2) + return -EINVAL; + str_len = length * 2 + (prefix ? 2 : 0) + 1; ret = calloc(1, str_len); if (ret == NULL) diff --git a/libkmipclient/utils.h b/libkmipclient/utils.h index a8ef8c5c..8728fbe3 100644 --- a/libkmipclient/utils.h +++ b/libkmipclient/utils.h @@ -38,7 +38,7 @@ int kmip_parse_decimal_uint(const char *str, uint64_t *val); int kmip_parse_hex_int(const char *str, int64_t *val); int kmip_parse_hex(const char *str, bool has_prefix, unsigned char **val, uint32_t *length); -int kmip_format_hex(const unsigned char *val, uint32_t length, bool prefix, +int kmip_format_hex(const unsigned char *val, size_t length, bool prefix, char **str); int kmip_parse_bignum(const char *str, bool has_prefix, BIGNUM **bn);