lib/mpi: mpi_read_from_buffer(): return -EINVAL upon too short buffer (7af791e0) · Commits · 戴 / test

Currently, if the input buffer is shorter than the expected length as indicated by its first two bytes, an MPI instance of this expected length will be allocated and filled with as much data as is available. The rest will remain uninitialized. Instead of leaving this condition undetected, an error code should be reported to the caller. Since this situation indicates that the input buffer's first two bytes, encoding the number of expected bits, are garbled, -EINVAL is appropriate here. If the input buffer is shorter than indicated by its first two bytes, make mpi_read_from_buffer() return -EINVAL. Get rid of the 'nread' variable: with the new semantics, the total number of bytes read from the input buffer is known in advance. Signed-off-by:

Nicolai Stange <nicstange@gmail.com> Signed-off-by:

Herbert Xu <herbert@gondor.apana.org.au>

lib/mpi/mpicoder.c

+8 −10

Original line number	Diff line number	Diff line
		@@ -81,7 +81,7 @@ MPI mpi_read_from_buffer(const void xbuffer, unsigned ret_nread)
		{
		const uint8_t *buffer = xbuffer;
		int i, j;
		unsigned nbits, nbytes, nlimbs, nread = 0;
		unsigned nbits, nbytes, nlimbs;
		mpi_limb_t a;
		MPI val = NULL;

		@@ -94,9 +94,14 @@ MPI mpi_read_from_buffer(const void xbuffer, unsigned ret_nread)
		return ERR_PTR(-EINVAL);
		}
		buffer += 2;
		nread = 2;

		nbytes = DIV_ROUND_UP(nbits, 8);
		if (nbytes + 2 > *ret_nread) {
		printk("MPI: mpi larger than buffer nread=%d ret_nread=%d\n",
		ret_nread + 1, ret_nread);
		return ERR_PTR(-EINVAL);
		}

		nlimbs = DIV_ROUND_UP(nbytes, BYTES_PER_MPI_LIMB);
		val = mpi_alloc(nlimbs);
		if (!val)
		@@ -109,12 +114,6 @@ MPI mpi_read_from_buffer(const void xbuffer, unsigned ret_nread)
		for (; j > 0; j--) {
		a = 0;
		for (; i < BYTES_PER_MPI_LIMB; i++) {
		if (++nread > *ret_nread) {
		printk
		("MPI: mpi larger than buffer nread=%d ret_nread=%d\n",
		nread, *ret_nread);
		goto leave;
		}
		a <<= 8;
		a \|= *buffer++;
		}
		@@ -122,8 +121,7 @@ MPI mpi_read_from_buffer(const void xbuffer, unsigned ret_nread)
		val->d[j - 1] = a;
		}

		leave:
		*ret_nread = nread;
		*ret_nread = nbytes + 2;
		return val;
		}
		EXPORT_SYMBOL_GPL(mpi_read_from_buffer);

Admin message