Re: [PATCH net-next] tipc: potential memory corruption in tipc_crypto_key_rcv()

2020-09-23 Thread David Miller
From: Dan Carpenter Date: Wed, 23 Sep 2020 11:30:17 +0300 > This code uses "skey->keylen" as an memcpy() size and then checks that > it is valid on the next line. The other problem is that the check has > a potential integer overflow, it's better to use struct_size() for this. > > Fixes: 23700d

[PATCH net-next] tipc: potential memory corruption in tipc_crypto_key_rcv()

2020-09-23 Thread Dan Carpenter
This code uses "skey->keylen" as an memcpy() size and then checks that it is valid on the next line. The other problem is that the check has a potential integer overflow, it's better to use struct_size() for this. Fixes: 23700da29b83 ("tipc: add automatic rekeying for encryption key") Signed-off-