3 Commits

Author	SHA1	Message	Date
Ingo Franzki	c7d0d3c1b9	libkmipclient: Fix integer overflow in kmip_format_hex() ... If length is >= 0x80000000 (2 GB), length * 2 wraps around to a small value, calloc allocates a too small buffer, then the loop writes length * 2 bytes into it causing a heap buffer overflow. Fix this by using a size_t for size calculation, and also checking the length before multiplication (needed on 32 bit platforms). Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>	2026-07-20 15:25:58 +02:00
Ingo Franzki	f0bf1985c3	libkmipclient: Protect from symlink-following attacks ... When creating or writing files, make sure that the file is not a sysmlink. Such files created by libkmipclient are typically stored inside the zkey repository and the owner and mode of them are changed to. allow read/write for the owner user and the 'zkeyadm' group. It would allow a symlink-following attack if the file being created are symlinks. Make sure to open such files with the 'O_NOFOLLOW' flag. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>	2026-07-20 15:25:58 +02:00
Ingo Franzki	56fecf1832	libkmipclient: Add KMIP client shared library ... libkmipclient is a shared library that provides an KMIP client to communicate with an KMIP server. KMIP stands for Key Management Interoperability Protocol, and is an extensible communication protocol that defines message formats for the manipulation of cryptographic keys on a key management server. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>	2021-07-07 13:53:06 +02:00