diff options
| author | Emil Velikov <emil.velikov@collabora.com> | 2023-02-06 14:32:59 +0000 |
|---|---|---|
| committer | Lucas De Marchi <lucas.de.marchi@gmail.com> | 2023-02-09 12:08:14 -0800 |
| commit | b9605c63b859adfffc0b4b9420d720aa323b90e9 (patch) | |
| tree | 4df18e96caa4810e1e80be995dc28b7384837997 | |
| parent | 96152dd687274c21edf3c21c2cb5673de3766901 (diff) | |
| download | kmod-b9605c63b859adfffc0b4b9420d720aa323b90e9.tar.gz kmod-b9605c63b859adfffc0b4b9420d720aa323b90e9.tar.bz2 kmod-b9605c63b859adfffc0b4b9420d720aa323b90e9.zip | |
libkmod: error out on unknown hash algorithm
Currently if we see unknown algorithm, we'll do an OOB read in
pkey_hash_algo. This can happen for example if OPENSSL_NO_SM3 is set and
the kernel module uses a SM3 hash.
Cc: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Signed-off-by: Emil Velikov <emil.velikov@collabora.com>
Signed-off-by: Lucas De Marchi <lucas.de.marchi@gmail.com>
| -rw-r--r-- | libkmod/libkmod-signature.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libkmod/libkmod-signature.c b/libkmod/libkmod-signature.c index 092f396..b749a81 100644 --- a/libkmod/libkmod-signature.c +++ b/libkmod/libkmod-signature.c @@ -219,6 +219,7 @@ static bool fill_pkcs7(const char *mem, off_t size, unsigned char *key_id_str; struct pkcs7_private *pvt; const char *issuer_str; + int hash_algo; size -= sig_len; pkcs7_raw = mem + size; @@ -277,7 +278,10 @@ static bool fill_pkcs7(const char *mem, off_t size, X509_ALGOR_get0(&o, NULL, NULL, dig_alg); - sig_info->hash_algo = pkey_hash_algo[obj_to_hash_algo(o)]; + hash_algo = obj_to_hash_algo(o); + if (hash_algo < 0) + goto err3; + sig_info->hash_algo = pkey_hash_algo[hash_algo]; // hash algo has not been recognized if (sig_info->hash_algo == NULL) goto err3; |