From 054b6be05b15a8b4ddcad44711698e9a3abb700b Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Wed, 20 Mar 2019 10:33:45 +0100 Subject: [PATCH] ask-password: add extra paranoid overflow check --- src/shared/ask-password-api.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/shared/ask-password-api.c b/src/shared/ask-password-api.c index 88335c6d085..ab0c34692f1 100644 --- a/src/shared/ask-password-api.c +++ b/src/shared/ask-password-api.c @@ -77,13 +77,18 @@ static int retrieve_key(key_serial_t serial, char ***ret) { n = keyctl(KEYCTL_READ, (unsigned long) serial, (unsigned long) p, (unsigned long) m, 0); if (n < 0) return -errno; - if (n < m) break; explicit_bzero_safe(p, n); - free(p); + + if (m > LONG_MAX / 2) /* overflow check */ + return -ENOMEM; m *= 2; + if ((long) (size_t) m != m) /* make sure that this still fits if converted to size_t */ + return -ENOMEM; + + free(p); } l = strv_parse_nulstr(p, n); -- 2.47.3