Commit 9f4f591c authored by Miguel García's avatar Miguel García Committed by Steffen Klassert
Browse files

xfrm: xfrm_user: use strscpy() for alg_name 



Replace the strcpy() calls that copy the canonical algorithm name into
alg_name with strscpy() to avoid potential overflows and guarantee NULL
termination.

Destination is alg_name in xfrm_algo/xfrm_algo_auth/xfrm_algo_aead
(size CRYPTO_MAX_ALG_NAME).

Tested in QEMU (BusyBox/Alpine rootfs):
 - Added ESP AEAD (rfc4106(gcm(aes))) and classic ESP (sha256 + cbc(aes))
 - Verified canonical names via ip -d xfrm state
 - Checked IPComp negative (unknown algo) and deflate path

Signed-off-by: default avatarMiguel García <miguelgarciaroman8@gmail.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 2327a3d6

net/xfrm/xfrm_user.c

+5 −5
Original line number Diff line number Diff line
@@ -593,7 +593,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props, 
	if (!p)

		return -ENOMEM;



	strcpy(p->alg_name, algo->name);

	strscpy(p->alg_name, algo->name);

	*algpp = p;

	return 0;

}
@@ -620,7 +620,7 @@ static int attach_crypt(struct xfrm_state *x, struct nlattr *rta, 
	if (!p)

		return -ENOMEM;



	strcpy(p->alg_name, algo->name);

	strscpy(p->alg_name, algo->name);

	x->ealg = p;

	x->geniv = algo->uinfo.encr.geniv;

	return 0;
@@ -649,7 +649,7 @@ static int attach_auth(struct xfrm_algo_auth **algpp, u8 *props, 
	if (!p)

		return -ENOMEM;



	strcpy(p->alg_name, algo->name);

	strscpy(p->alg_name, algo->name);

	p->alg_key_len = ualg->alg_key_len;

	p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;

	memcpy(p->alg_key, ualg->alg_key, (ualg->alg_key_len + 7) / 8);
@@ -684,7 +684,7 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props, 
	if (!p)

		return -ENOMEM;



	strcpy(p->alg_name, algo->name);

	strscpy(p->alg_name, algo->name);

	if (!p->alg_trunc_len)

		p->alg_trunc_len = algo->uinfo.auth.icv_truncbits;
@@ -714,7 +714,7 @@ static int attach_aead(struct xfrm_state *x, struct nlattr *rta, 
	if (!p)

		return -ENOMEM;



	strcpy(p->alg_name, algo->name);

	strscpy(p->alg_name, algo->name);

	x->aead = p;

	x->geniv = algo->uinfo.aead.geniv;

	return 0;