Re: [PATCH v2 1/2] af_key: Always verify length of provided sadb_key

2018-04-09 Thread Steffen Klassert
On Sat, Apr 07, 2018 at 11:40:33AM -0400, Kevin Easton wrote: > Key extensions (struct sadb_key) include a user-specified number of key > bits. The kernel uses that number to determine how much key data to copy > out of the message in pfkey_msg2xfrm_state(). > > The length of the sadb_key message

[PATCH v2 1/2] af_key: Always verify length of provided sadb_key

2018-04-07 Thread Kevin Easton
Key extensions (struct sadb_key) include a user-specified number of key bits. The kernel uses that number to determine how much key data to copy out of the message in pfkey_msg2xfrm_state(). The length of the sadb_key message must be verified to be long enough, even in the case of SADB_X_AALG_NUL