[SSSD] [PATCH] Out-of-bounds read fix in hmac-sha-1
Jakub Hrozek
jhrozek at redhat.com
Fri Sep 7 12:25:37 UTC 2012
On Fri, Sep 07, 2012 at 08:20:29AM -0400, Simo Sorce wrote:
> On Fri, 2012-09-07 at 10:56 +0200, Ondrej Kos wrote:
> > fixes https://fedorahosted.org/sssd/ticket/1331
> >
> > Although the given memset wasn't doing anything when *key_len ==
> > HMAC_SHA1_BLOCKSIZE* (length of bytes to set was 0), the first argument
> > to memset was an address starting right after the key itself -
> > out-of-bounds.
>
> I haven't looked at the rest of the code, but a more defensive way of
> doing the test is checking key_len < HMAC_SHA1_BLOCKSIZE, and not just
> checking it is different.
>
That branch is only ever reachable if key_len < HMAC_SHA1_BLOCKSIZE. The
whole logic looks like:
if (key_len > HMAC_SHA1_BLOCKSIZE) {
/* shorten the key */
} else {
/* this branch is reachable only if key_len <= HMAC_SHA1_BLOCKSIZE
*/
if (key_len != HMAC_SHA1_BLOCKSIZE) {
memset(ikey + key_len, 0, HMAC_SHA1_BLOCKSIZE - key_len);
}
}
More information about the sssd-devel
mailing list