[PATCH] crypto: fix copy size causing overruns/crashing

[Will Dietz <w@wdtz.org>]

[-- Attachment #1: Type: text/plain, Size: 1053 bytes --]

num_ad is already accounted for in `sizeof(iov)`
as iov has size `sizeof(struct iovec) * (num_ad+1)`.
---
 src/crypto.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/crypto.c b/src/crypto.c
index 632117d..62edd44 100644
--- a/src/crypto.c
+++ b/src/crypto.c
@@ -311,7 +311,7 @@ bool aes_siv_encrypt(const uint8_t *key, size_t key_len, const uint8_t *in,
        struct iovec iov[num_ad + 1];
        uint8_t v[16];
 
-       memcpy(iov, ad, sizeof(iov) * num_ad);
+       memcpy(iov, ad, sizeof(struct iovec) * num_ad);
        iov[num_ad].iov_base = (void *)in;
        iov[num_ad].iov_len = in_len;
        num_ad++;
@@ -368,7 +368,7 @@ bool aes_siv_decrypt(const uint8_t *key, size_t key_len, const uint8_t *in,
        if (in_len < 16)
                return false;
 
-       memcpy(iov, ad, sizeof(iov) * num_ad);
+       memcpy(iov, ad, sizeof(struct iovec) * num_ad);
        iov[num_ad].iov_base = (void *)out;
        iov[num_ad].iov_len = in_len - 16;
        num_ad++;
-- 
2.23.GIT

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]