mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-11-02 23:54:33 +01:00
Eric Biggers
3619dec510
Commit383203eff7("dh key: get rid of stack allocated array") changed kdf_ctr() to assume that the length of key material to derive is a multiple of the digest size. The length was supposed to be rounded up accordingly. However, the round_up() macro was used which only gives the correct result on power-of-2 arguments, whereas not all hash algorithms have power-of-2 digest sizes. In some cases this resulted in a write past the end of the 'outbuf' buffer. Fix it by switching to roundup(), which works for non-power-of-2 inputs. Reported-by: [email protected] Reported-by: [email protected] Reported-by: [email protected] Reported-by: [email protected] Fixes:383203eff7("dh key: get rid of stack allocated array") Signed-off-by: Eric Biggers <[email protected]> Acked-by: Kees Cook <[email protected]> Acked-by: Tycho Andersen <[email protected]> Signed-off-by: James Morris <[email protected]>