David Howells
23c8a812dc
KEYS: Fix ASN.1 indefinite length object parsing ...
This fixes CVE-2016-0758.
In the ASN.1 decoder, when the length field of an ASN.1 value is extracted,
it isn't validated against the remaining amount of data before being added
to the cursor. With a sufficiently large size indicated, the check:
datalen - dp < 2
may then fail due to integer overflow.
Fix this by checking the length indicated against the amount of remaining
data in both places a definite length is determined.
Whilst we're at it, make the following changes:
(1) Check the maximum size of extended length does not exceed the capacity
of the variable it's being stored in (len) rather than the type that
variable is assumed to be (size_t).
(2) Compare the EOC tag to the symbolic constant ASN1_EOC rather than the
integer 0.
(3) To reduce confusion, move the initialisation of len outside of:
for (len = 0; n > 0; n--) {
since it doesn't have anything to do with the loop counter n.
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: David Woodhouse <David.Woodhouse@intel.com>
Acked-by: Peter Jones <pjones@redhat.com>
2016-05-12 12:01:49 +01:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2016-03-17 21:38:27 -07:00
fonts: Add 6x10 font
2014-10-09 11:35:48 +03:00
lib: lz4: cleanup unaligned access efficiency detection
2016-04-13 09:22:49 -07:00
lzo: check for length overrun in variable length encoding.
2014-09-28 11:08:01 +02:00
lib/mpi: use "static inline" instead of "extern inline"
2016-02-28 03:26:34 +08:00
powerpc: Create disable_kernel_{fp,altivec,vsx,spe}()
2015-12-01 13:52:25 +11:00
lib/xz: enable all filters by default in Kconfig
2014-06-04 16:54:18 -07:00
zlib_deflate/deftree: remove bi_reverse()
2015-09-10 13:29:01 -07:00
zlib: clean up some dead code
2014-08-06 18:01:24 -07:00
argv_split(): teach it to handle mutable strings
2013-04-29 18:28:19 -07:00
KEYS: Fix ASN.1 indefinite length object parsing
2016-05-12 12:01:49 +01:00
assoc_array: don't call compare_object() on a node
2016-04-06 14:06:48 +01:00
atomic: Provide atomic_{or,xor,and}
2015-07-27 14:06:24 +02:00
x86/cpufeature: Carve out X86_FEATURE_*
2016-01-30 11:22:17 +01:00
syscalls: implement execveat() system call
2014-12-13 12:42:51 -08:00
lib/bitmap.c: conversion routines to/from u32 array
2016-02-19 22:54:09 -05:00
ARM: 8187/1: add CONFIG_HAVE_ARCH_BITREVERSE to support rbit instruction
2014-12-22 16:43:06 +00:00
treewide: Remove old email address
2015-11-23 09:44:58 +01:00
lib/bug.c: use common WARN helper
2016-03-17 15:09:34 -07:00
X.509: do not emit any informational output
2013-06-19 17:54:06 +02:00
printk: Provide a wake_up_klogd() off-case
2013-03-22 16:41:20 -07:00
ipv4: Update parameters for csum_tcpudp_magic to their original types
2016-03-13 23:55:13 -04:00
lib/clz_ctz.c: add prototype declarations in lib/clz_ctz.c
2014-04-03 16:21:12 -07:00
lib: Add a generic cmdline parse function parse_option_str
2014-10-03 18:40:58 +01:00
audit: Add generic compat syscall support
2014-03-20 10:11:35 -04:00
sched/topology: Rename topology_thread_cpumask() to topology_sibling_cpumask()
2015-05-27 15:22:15 +02:00
cpumask: Export cpumask_any_but()
2016-02-29 09:35:20 +01:00
lib: crc-itu-t.[ch] fix 0x0x prefix in integer constants
2015-05-26 15:26:43 +02:00
lib: introduce crc_t10dif_update()
2015-05-30 22:42:24 -07:00
lib/crc7: Shift crc7() output left 1 bit
2014-05-16 14:26:52 -04:00
lib: crc32: Add some additional __pure annotations
2014-06-25 16:04:00 -07:00
kbuild: include core debug info when DEBUG_INFO_REDUCED
2015-06-11 15:08:32 +02:00
mutex: Add support for wound/wait style locks
2013-06-26 12:10:56 +02:00
debugobjects: Allow bigger number of early boot objects
2016-01-27 15:40:59 +01:00
lib/decompress: set the compressor name to NULL on error
2015-07-17 16:39:54 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
lib/decompress_unlzma: Do a NULL check for pointer
2015-09-10 13:29:01 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
devres: use to_pci_dev()
2016-02-07 23:17:59 -08:00
KEYS: Merge the type-specific data with the payload data
2015-10-21 15:18:36 +01:00
__div64_32(): make it overridable at compile time
2015-11-16 14:42:12 -05:00
dma-debug: switch check from _text to _stext
2016-01-14 16:00:49 -08:00
dma: Provide simple noop dma ops
2016-03-02 17:01:55 +02:00
dump_stack: avoid potential deadlocks
2016-02-05 18:10:40 -08:00
convert a bunch of open-coded instances of memdup_user_nul()
2016-01-04 10:26:58 -05:00
lib/dynamic_queue_limits.c: simplify includes
2015-02-12 18:54:15 -08:00
earlycpio.c: Fix the confusing comment of find_cpio_data().
2013-08-14 23:24:01 +02:00
extable: add support for relative extables to search and sort routines
2016-02-24 14:57:26 +00:00
fault-inject: fix inverted interval/probability values in printk
2015-10-23 17:55:10 +09:00
lib: add fdt_empty_tree.c
2014-04-30 19:49:37 +01:00
lib: rename lib/find_next_bit.c to lib/find_bit.c
2015-04-17 09:03:54 -04:00
reciprocal_divide: update/correction of the algorithm
2014-01-21 23:17:20 -08:00
lib+mm: fix few spelling mistakes
2016-02-15 11:18:23 +01:00
lib: crc32: constify crc32 lookup table
2015-02-13 21:21:35 -08:00
CPM/QE: use genalloc to manage CPM/QE muram
2015-12-22 17:10:18 -06:00
lib/glob.c: add CONFIG_GLOB_SELFTEST
2014-08-06 18:01:25 -07:00
lib/halfmd4.c: use rol32 inline function in the ROUND macro
2015-11-06 17:50:42 -08:00
lib/hexdump.c: truncate output in case of overflow
2015-11-06 17:50:42 -08:00
Make ARCH_HAS_FAST_MULTIPLIER a real config variable
2014-09-13 11:14:53 -07:00
mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd
2015-11-06 17:50:42 -08:00
lib/int_sqrt.c: optimize square root algorithm
2013-04-29 18:28:19 -07:00
lib/interval_tree.c: simplify includes
2015-02-12 18:54:15 -08:00
lib: Export interval_tree
2014-05-05 09:09:14 +02:00
Kconfig: rename HAS_IOPORT to HAS_IOPORT_MAP
2014-04-07 16:36:11 -07:00
lib/iomap_copy.c: add __ioread32_copy()
2016-01-20 17:09:18 -08:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
2015-11-05 16:34:48 -08:00
x86, mm: support huge KVA mappings on x86
2015-04-14 16:49:04 -07:00
iov_iter: export import_single_range()
2015-12-06 20:42:19 -05:00
irq_poll: Fix irq_poll_sched()
2016-01-19 15:26:55 -05:00
lib/is_single_threaded.c: change current_is_single_threaded() to use for_each_thread()
2015-11-06 17:50:42 -08:00
lib/kasprintf.c: add sanity check to kvasprintf
2016-01-16 11:17:27 -08:00
mm, kasan: stackdepot implementation. Enable stackdepot for SLAB
2016-03-25 16:37:42 -07:00
parisc,metag: Implement CONFIG_DEBUG_STACK_USAGE option
2016-03-23 15:44:34 +01:00
mm, kasan: stackdepot implementation. Enable stackdepot for SLAB
2016-03-25 16:37:42 -07:00
kdb: Allow access to sensitive commands to be restricted by default
2014-11-11 09:31:52 -06:00
ubsan: fix tree-wide -Wmaybe-uninitialized false positives
2016-03-22 15:36:02 -07:00
kfifo: use BUG_ON
2014-08-08 15:57:25 -07:00
klist: fix starting point removed bug in klist iterators
2016-02-07 22:18:47 -08:00
kobject: export kset_find_obj() for module use
2016-02-09 17:36:34 -08:00
lib/kobject_uevent.c: remove redundant include
2015-02-12 18:54:15 -08:00
lib: add "on"/"off" support to kstrtobool
2016-03-17 15:09:34 -07:00
block: fix blk_stack_limits() regression due to lcm() change
2015-03-31 09:45:50 -06:00
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2016-01-22 11:58:43 -08:00
list: kill list_force_poison()
2016-03-09 15:43:42 -08:00
lib/list_sort: use late_initcall to hook in self tests
2015-06-16 14:12:35 -04:00
lib/llist.c: fix data race in llist_del_first
2015-11-06 17:50:42 -08:00
locking/lockdep: Revert qrwlock recusive stuff
2014-10-03 06:09:30 +02:00
locking/lockref: Remove homebrew cmpxchg64_relaxed() macro definition
2015-08-12 11:59:04 +02:00
lru_cache: Converted lc_seq_printf_status to return void
2015-11-25 09:22:02 -07:00
mm, kasan: stackdepot implementation. Enable stackdepot for SLAB
2016-03-25 16:37:42 -07:00
lib/md5.c: simplify include
2015-02-12 18:54:15 -08:00
mac_pton: Use bool not int return
2014-06-25 17:45:43 -07:00
net: Add support for CHANGEUPPER notifier error injection
2015-12-03 11:49:23 -05:00
netlink: pad nla_memcpy dest buffer with zeroes
2015-03-31 14:07:24 -04:00
ARM: 8439/1: Fix backtrace generation when IPI is masked
2015-10-03 16:40:51 +01:00
mode_t, whack-a-mole at 11...
2013-04-09 14:13:05 -04:00
powerpc+of: Rename and fix OF reconfig notifier error inject module
2012-12-14 10:32:52 +11:00
Give the OID registry file module info to avoid kernel tainting
2013-05-05 14:38:00 -07:00
once: make helper generic for calling functions once
2015-10-08 05:26:36 -07:00
lib/parser.c: put EXPORT_SYMBOLs in the conventional place
2014-01-23 16:36:55 -08:00
libnvdimm for 4.3:
2015-09-08 14:35:59 -07:00
lib+mm: fix few spelling mistakes
2016-02-15 11:18:23 +01:00
percpu_counter: batch size aware __percpu_counter_compare()
2015-05-29 07:39:34 +10:00
mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM
2015-11-06 17:50:42 -08:00
percpu: add test module for various percpu operations
2013-11-13 12:09:11 +09:00
lib/plist.c: remove redundant include
2015-02-12 18:54:16 -08:00
treewide: Remove old email address
2015-11-23 09:44:58 +01:00
radix_tree: add radix_tree_dump
2016-03-17 15:09:34 -07:00
netfilter: meta: add PRANDOM support
2016-02-29 13:55:59 +01:00
ratelimit: fix bug in time interval by resetting right begin time
2016-01-21 17:20:51 -08:00
rbtree: Make lockless searches non-fatal
2015-05-28 11:32:04 +09:30
rbtree/test: test rbtree_postorder_for_each_entry_safe()
2014-01-23 16:37:03 -08:00
reciprocal_divide: update/correction of the algorithm
2014-01-21 23:17:20 -08:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2015-12-31 18:20:10 -05:00
scatterlist: fix a typo in comment block of sg_miter_stop()
2016-02-08 10:15:17 -08:00
tracing: Use seq_buf_used() in seq_buf_to_user() instead of len
2015-12-23 14:27:20 -05:00
lib: scatterlist: add sg splitting function
2015-08-24 14:28:01 -06:00
lib: EXPORT_SYMBOL sha_init
2015-03-23 22:12:08 -04:00
lib/show_mem.c: correct reserved memory calculation
2015-09-08 15:35:28 -07:00
percpu: add preemption checks to __this_cpu ops
2014-04-07 16:36:14 -07:00
lib/sort: Add 64 bit swap function
2015-06-25 17:00:40 -07:00
lib/stackdepot: avoid to return 0 handle
2016-05-05 17:38:53 -07:00
lib/stmp_device.c: replace module.h include
2015-02-12 18:54:16 -08:00
lib: move strtobool() to kstrtobool()
2016-03-17 15:09:34 -07:00
string_helpers: fix precision loss for some inputs
2016-01-20 17:09:18 -08:00
Use the new batched user accesses in generic user string handling
2015-12-17 10:05:19 -08:00
Use the new batched user accesses in generic user string handling
2015-12-17 10:05:19 -08:00
Merge branch 'for-4.2/sg' of git://git.kernel.dk/linux-block
2015-06-25 15:22:36 -07:00
lib/syscall.c: unexport task_current_syscall()
2014-04-03 16:21:06 -07:00
kstrto*: accept "-0" for signed conversion
2015-09-10 13:29:01 -07:00
lib/test-string_helpers.c: fix and improve string_get_size() tests
2016-02-03 08:28:43 -08:00
test_bitmap: unit tests for lib/bitmap.c
2016-02-19 22:54:09 -05:00
lib/test_bpf: Add additional BPF_ADD tests
2016-04-06 16:47:51 -04:00
test: firmware_class: add asynchronous request trigger
2016-01-07 13:44:22 -07:00
test_hexdump: print statistics at the end
2016-01-20 17:09:18 -08:00
kasan: test fix: warn if the UAF could not be detected in kmalloc_uaf2
2016-03-25 16:37:42 -07:00
test: add minimal module for verification testing
2014-01-23 16:36:57 -08:00
mm, printk: introduce new format string for flags
2016-03-15 16:55:16 -07:00
rhashtable-test: allow to retry even if -ENOMEM was returned
2015-11-23 12:36:08 -05:00
locking/static_keys: Provide a selftest
2015-08-03 11:51:12 +02:00
locking/static_keys: Avoid nested functions
2016-02-09 10:27:29 +01:00
test: check copy_to/from_user boundary validation
2014-01-23 16:36:57 -08:00
lib/textsearch.c: remove textsearch_put reference from comments
2014-10-14 02:18:14 +02:00
timerqueue: Let timerqueue_add/del return information
2015-04-22 17:06:49 +02:00
UBSAN: run-time undefined behavior sanity checker
2016-01-20 17:09:18 -08:00
UBSAN: run-time undefined behavior sanity checker
2016-01-20 17:09:18 -08:00
lib/ucs2_string: Correct ucs2 -> utf8 conversion
2016-02-16 12:49:05 +00:00
Kconfig: consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
2013-04-30 17:04:09 -07:00
uuid: use prandom_bytes()
2013-04-29 18:28:42 -07:00
sscanf: implement basic character sets
2016-03-17 15:09:34 -07:00
23c8a812dc