Attila Fülöp 54c8366e39 ICP: Fix null pointer dereference and use after free ... In gcm_mode_decrypt_contiguous_blocks(), if vmem_alloc() fails, bcopy is called with a NULL pointer destination and a length > 0. This results in undefined behavior. Further ctx->gcm_pt_buf is freed but not set to NULL, leading to a potential write after free and a double free due to missing return value handling in crypto_update_uio(). The code as is may write to ctx->gcm_pt_buf in gcm_decrypt_final() and may free ctx->gcm_pt_buf again in aes_decrypt_atomic(). The fix is to slightly rework error handling and check the return value in crypto_update_uio(). Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov> Reviewed-by: Tom Caputi <tcaputi@datto.com> Reviewed-by: Kjeld Schouten <kjeld@schouten-lebbing.nl> Signed-off-by: Attila Fülöp <attila@fueloep.org> Closes #9659		2019-12-03 10:28:47 -08:00
..
kcf_callprov.c	Fix spelling	2017-01-03 11:31:18 -06:00
kcf_mech_tabs.c	Fix typos in modules/icp/	2019-08-30 14:26:07 -07:00
kcf_prov_lib.c	ICP: Fix null pointer dereference and use after free	2019-12-03 10:28:47 -08:00
kcf_prov_tabs.c	Add missing *_destroy/*_fini calls	2017-05-04 19:26:28 -04:00
kcf_sched.c	Fix typos in modules/icp/	2019-08-30 14:26:07 -07:00