Re: [PATCH] crypto: fix OOB read in pefile_digest_pe_contents

[Weiming Shi <bestswngs@gmail.com>]

On 26-05-05 13:46, Herbert Xu wrote:
> > 
> > diff --git a/crypto/asymmetric_keys/verify_pefile.c b/crypto/asymmetric_keys/verify_pefile.c
> > index 1f3b227ba7f2..cec99db14129 100644
> > --- a/crypto/asymmetric_keys/verify_pefile.c
> > +++ b/crypto/asymmetric_keys/verify_pefile.c
> > @@ -305,6 +305,8 @@ static int pefile_digest_pe_contents(const void *pebuf, unsigned int pelen,
> >  
> >  	if (pelen > hashed_bytes) {
> >  		tmp = hashed_bytes + ctx->certs_size;
> > +		if (tmp <= hashed_bytes || pelen < tmp)
> > +			return -ELIBBAD;
> 
> I know nothing about this but why should pelen == tmp fail?
> 
> Cheers,
> -- 
> Email: Herbert Xu <herbert@gondor.apana.org.au>
> Home Page: http://gondor.apana.org.au/~herbert/
> PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Hi Herbert,

Do you mean this should be `pelen <= tmp` ?

pelen == tmp means the cert table sits right at EOF with no trailing data 
in between - that's a legitimate layout.

Weiming Shi