Validate that the provided rte_crypto_auth_xform's key length is not too large, and that the provided data pointer is not NULL.
Previously, providing a key which has a size > SHA_BLOCK_MAX will cause the key memcpy to write out of bounds. Since the rte_crypto_auth_xform documentation states that it is the user's responsibility to validate the authentication key length, this is not a bug in DPDK. However, other PMDs are validating this, and it is more user-friendly to do so - with negligible performance impact. Reported-by: pengpeng <[email protected]> Signed-off-by: Jack Bond-Preston <[email protected]> Reviewed-by: Wathsala Vithanage <[email protected]> --- drivers/crypto/armv8/rte_armv8_pmd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/crypto/armv8/rte_armv8_pmd.c b/drivers/crypto/armv8/rte_armv8_pmd.c index a7caac186d..f4ddfb6395 100644 --- a/drivers/crypto/armv8/rte_armv8_pmd.c +++ b/drivers/crypto/armv8/rte_armv8_pmd.c @@ -262,6 +262,13 @@ auth_set_prerequisites(struct armv8_crypto_session *sess, uint8_t partial[64] = { 0 }; int error; + /* Validate key */ + if (xform->auth.key.data == NULL || + xform->auth.key.length > SHA_BLOCK_MAX) { + ARMV8_CRYPTO_LOG_ERR("Invalid authentication key provided."); + return -1; + } + switch (xform->auth.algo) { case RTE_CRYPTO_AUTH_SHA1_HMAC: /* -- 2.43.0
