⬢ DragonFlyBSD Kernel Audit
DF-3568 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
--- a/sys/crypto/rijndael/rijndael-api.c
+++ b/sys/crypto/rijndael/rijndael-api.c
@@ -34,10 +34,17 @@
 
 #include <crypto/rijndael/rijndael.h>
 
+#define	RIJNDAEL_VALID_NR(n)	((n) == 10 || (n) == 12 || (n) == 14)
+
 void
 rijndael_set_key(rijndael_ctx *ctx, const u_char *key, int bits)
 {
 
+	if (bits != 128 && bits != 192 && bits != 256) {
+		KASSERT(0, ("rijndael_set_key: invalid key size (%d)", bits));
+		ctx->Nr = 0;		/* marked unusable */
+		return;			/* NB: no key material is read */
+	}
 	ctx->Nr = rijndaelKeySetupEnc(ctx->ek, key, bits);
 	rijndaelKeySetupDec(ctx->dk, key, bits);
 }
@@ -46,6 +53,8 @@
 rijndael_decrypt(const rijndael_ctx *ctx, const u_char *src, u_char *dst)
 {
 
+	if (!RIJNDAEL_VALID_NR(ctx->Nr))
+		return;			/* refuse unusable schedule */
 	rijndaelDecrypt(ctx->dk, ctx->Nr, src, dst);
 }
 
@@ -53,5 +62,7 @@
 rijndael_encrypt(const rijndael_ctx *ctx, const u_char *src, u_char *dst)
 {
 
+	if (!RIJNDAEL_VALID_NR(ctx->Nr))
+		return;			/* refuse unusable schedule */
 	rijndaelEncrypt(ctx->ek, ctx->Nr, src, dst);
 }