From: Rupesh Chiluka <[email protected]> In cn10k_cpt_tls12_trim_mac() the padding length is derived from the decrypted record. trim_len was used to compute mac_offset/pad_offset without checking it against the record length, causing out-of-bounds reads and corrupted mbuf lengths in both direct and SG modes.
Reject records where trim_len exceeds the record length. Signed-off-by: Rupesh Chiluka <[email protected]> --- drivers/crypto/cnxk/cn10k_cryptodev_ops.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c index bf273774fd..30ef0d14c2 100644 --- a/drivers/crypto/cnxk/cn10k_cryptodev_ops.c +++ b/drivers/crypto/cnxk/cn10k_cryptodev_ops.c @@ -942,6 +942,13 @@ cn10k_cpt_tls12_trim_mac(struct rte_crypto_op *cop, struct cpt_cn10k_res_s *res, pad_val = ((res->spi >> 16) & 0xff); pad_len = pad_val + 1; trim_len = pad_len + mac_len; + + if (trim_len > m_len) { + cop->status = RTE_CRYPTO_OP_STATUS_ERROR; + cop->aux_flags = res->uc_compcode; + return; + } + mac_offset = m_len - trim_len; pad_offset = mac_offset + mac_len; -- 2.43.0
