Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752317AbWCKClc (ORCPT ); Fri, 10 Mar 2006 21:41:32 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752320AbWCKClc (ORCPT ); Fri, 10 Mar 2006 21:41:32 -0500 Received: from CyborgDefenseSystems.Corporatebeast.com ([64.62.148.172]:20238 "EHLO arnor.apana.org.au") by vger.kernel.org with ESMTP id S1752315AbWCKClb (ORCPT ); Fri, 10 Mar 2006 21:41:31 -0500 Date: Sat, 11 Mar 2006 13:41:16 +1100 To: Adrian Bunk Cc: davem@davemloft.net, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [2.6 patch] crypto/aes.c: array overrun Message-ID: <20060311024116.GA21856@gondor.apana.org.au> References: <20060311010339.GF21864@stusta.de> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20060311010339.GF21864@stusta.de> User-Agent: Mutt/1.5.9i From: Herbert Xu Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1229 Lines: 39 On Sat, Mar 11, 2006 at 02:03:39AM +0100, Adrian Bunk wrote: > > ... > #define loop8(i) \ ... > t ^= E_KEY[8 * i + 7]; E_KEY[8 * i + 15] = t; \ > } > > static int > aes_set_key(void *ctx_arg, const u8 *in_key, unsigned int key_len, u32 *flags) > { > ... > case 32: > ... > for (i = 0; i < 7; ++i) > loop8 (i); OK this is not pretty but it is actually correct. Notice how we only overstep the mark for E_KEY but never for D_KEY. Since D_KEY is only initialised after this, it is OK for us to trash the start of D_KEY. It's just a trick that makes the code slightly nicer (and no I didn't write this nor am I necessarily condoning it :) Thanks for reporting this though. Cheers, -- Visit Openswan at http://www.openswan.org/ Email: Herbert Xu ~{PmV>HI~} Home Page: http://gondor.apana.org.au/~herbert/ PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/