Evolution-x-devices/kernel_google_b1c1
2
0
Fork 0
mirror of https://github.com/Evolution-X-Devices/kernel_google_b1c1 synced 2026-02-01 07:34:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

crypto: lrw - Fix out-of bounds access on counter overflow

Browse Source 
commit fbe1a850b3b1522e9fc22319ccbbcd2ab05328d2 upstream.

When the LRW block counter overflows, the current implementation returns
128 as the index to the precomputed multiplication table, which has 128
entries. This patch fixes it to return the correct value (127).

Fixes: 64470f1b85 ("[CRYPTO] lrw: Liskov Rivest Wagner, a tweakable narrow block cipher mode")
Cc: <stable@vger.kernel.org> # 2.6.20+
Reported-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ondrej Mosnacek
2018-09-13 10:51:31 +02:00
committed by Greg Kroah-Hartman
parent d699af340b
commit b957cd4d7d
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
crypto/lrw.c
View File

@@ -132,7 +132,12 @@ static inline int get_index128(be128 *block)
return x + ffz(val);
}
return x;
/*
* If we get here, then x == 128 and we are incrementing the counter
* from all ones to all zeros. This means we must return index 127, i.e.
* the one corresponding to key2*{ 1,...,1 }.
*/
return 127;
}
static int crypt(struct blkcipher_desc *d,