daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
Brian Stinson 2593d8
From c6c8e0d097d6ba12471c6112c3fd339ea40329d5 Mon Sep 17 00:00:00 2001
Brian Stinson 2593d8
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Brian Stinson 2593d8
Date: Mon, 13 May 2019 16:58:01 -0300
Brian Stinson 2593d8
Subject: [PATCH] ask-password: prevent buffer overrow when reading from
Brian Stinson 2593d8
 keyring
Brian Stinson 2593d8
Brian Stinson 2593d8
When we read from keyring, a temporary buffer is allocated in order to
Brian Stinson 2593d8
determine the size needed for the entire data. However, when zeroing that area,
Brian Stinson 2593d8
we use the data size returned by the read instead of the lesser size allocate
Brian Stinson 2593d8
for the buffer.
Brian Stinson 2593d8
Brian Stinson 2593d8
That will cause memory corruption that causes systemd-cryptsetup to crash
Brian Stinson 2593d8
either when a single large password is used or when multiple passwords have
Brian Stinson 2593d8
already been pushed to the keyring.
Brian Stinson 2593d8
Brian Stinson 2593d8
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Brian Stinson 2593d8
(cherry picked from commit 59c55e73eaee345e1ee67c23eace8895ed499693)
Brian Stinson 2593d8
Brian Stinson 2593d8
Resolves: #1752050
Brian Stinson 2593d8
---
Brian Stinson 2593d8
 src/shared/ask-password-api.c | 2 +-
Brian Stinson 2593d8
 1 file changed, 1 insertion(+), 1 deletion(-)
Brian Stinson 2593d8
Brian Stinson 2593d8
diff --git a/src/shared/ask-password-api.c b/src/shared/ask-password-api.c
Brian Stinson 2593d8
index 682dc754fc..764ebd08e1 100644
Brian Stinson 2593d8
--- a/src/shared/ask-password-api.c
Brian Stinson 2593d8
+++ b/src/shared/ask-password-api.c
Brian Stinson 2593d8
@@ -79,7 +79,7 @@ static int retrieve_key(key_serial_t serial, char ***ret) {
Brian Stinson 2593d8
                 if (n < m)
Brian Stinson 2593d8
                         break;
Brian Stinson 2593d8
 
Brian Stinson 2593d8
-                explicit_bzero(p, n);
Brian Stinson 2593d8
+                explicit_bzero(p, m);
Brian Stinson 2593d8
                 free(p);
Brian Stinson 2593d8
                 m *= 2;
Brian Stinson 2593d8
         }