From: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Date: Mon, 13 May 2019 19:58:01 +0000 (-0300)
Subject: ask-password: prevent buffer overrow when reading from keyring
X-Git-Tag: v243-rc1~438
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=59c55e73eaee345e1ee67c23eace8895ed499693;p=thirdparty%2Fsystemd.git

ask-password: prevent buffer overrow when reading from keyring

When we read from keyring, a temporary buffer is allocated in order to
determine the size needed for the entire data. However, when zeroing that area,
we use the data size returned by the read instead of the lesser size allocate
for the buffer.

That will cause memory corruption that causes systemd-cryptsetup to crash
either when a single large password is used or when multiple passwords have
already been pushed to the keyring.

Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---

diff --git a/src/shared/ask-password-api.c b/src/shared/ask-password-api.c
index ab0c34692f1..6c0a3699029 100644
--- a/src/shared/ask-password-api.c
+++ b/src/shared/ask-password-api.c
@@ -80,7 +80,7 @@ static int retrieve_key(key_serial_t serial, char ***ret) {
                 if (n < m)
                         break;
 
-                explicit_bzero_safe(p, n);
+                explicit_bzero_safe(p, m);
 
                 if (m > LONG_MAX / 2) /* overflow check */
                         return -ENOMEM;