daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
4fbe94
From c6c8e0d097d6ba12471c6112c3fd339ea40329d5 Mon Sep 17 00:00:00 2001
4fbe94
From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
4fbe94
Date: Mon, 13 May 2019 16:58:01 -0300
4fbe94
Subject: [PATCH] ask-password: prevent buffer overrow when reading from
4fbe94
 keyring
4fbe94
4fbe94
When we read from keyring, a temporary buffer is allocated in order to
4fbe94
determine the size needed for the entire data. However, when zeroing that area,
4fbe94
we use the data size returned by the read instead of the lesser size allocate
4fbe94
for the buffer.
4fbe94
4fbe94
That will cause memory corruption that causes systemd-cryptsetup to crash
4fbe94
either when a single large password is used or when multiple passwords have
4fbe94
already been pushed to the keyring.
4fbe94
4fbe94
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
4fbe94
(cherry picked from commit 59c55e73eaee345e1ee67c23eace8895ed499693)
4fbe94
4fbe94
Resolves: #1752050
4fbe94
---
4fbe94
 src/shared/ask-password-api.c | 2 +-
4fbe94
 1 file changed, 1 insertion(+), 1 deletion(-)
4fbe94
4fbe94
diff --git a/src/shared/ask-password-api.c b/src/shared/ask-password-api.c
4fbe94
index 682dc754fc..764ebd08e1 100644
4fbe94
--- a/src/shared/ask-password-api.c
4fbe94
+++ b/src/shared/ask-password-api.c
4fbe94
@@ -79,7 +79,7 @@ static int retrieve_key(key_serial_t serial, char ***ret) {
4fbe94
                 if (n < m)
4fbe94
                         break;
4fbe94
 
4fbe94
-                explicit_bzero(p, n);
4fbe94
+                explicit_bzero(p, m);
4fbe94
                 free(p);
4fbe94
                 m *= 2;
4fbe94
         }