[SSSD] [PATCH] Out-of-bounds read fix in hmac-sha-1

Jakub Hrozek jhrozek at redhat.com
Fri Sep 7 12:25:37 UTC 2012


On Fri, Sep 07, 2012 at 08:20:29AM -0400, Simo Sorce wrote:
> On Fri, 2012-09-07 at 10:56 +0200, Ondrej Kos wrote:
> > fixes https://fedorahosted.org/sssd/ticket/1331
> > 
> > Although the given memset wasn't doing anything when *key_len == 
> > HMAC_SHA1_BLOCKSIZE* (length of bytes to set was 0), the first argument 
> > to memset was an address starting right after the key itself - 
> > out-of-bounds.
> 
> I haven't looked at the rest of the code, but a more defensive way of
> doing the test is checking key_len < HMAC_SHA1_BLOCKSIZE, and not just
> checking it is different.
> 

That branch is only ever reachable if key_len < HMAC_SHA1_BLOCKSIZE. The
whole logic looks like:

if (key_len > HMAC_SHA1_BLOCKSIZE) {
    /* shorten the key */
} else {
    /* this branch is reachable only if key_len <= HMAC_SHA1_BLOCKSIZE
     */
    if (key_len != HMAC_SHA1_BLOCKSIZE) {
        memset(ikey + key_len, 0, HMAC_SHA1_BLOCKSIZE - key_len);
    }
}



More information about the sssd-devel mailing list