diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2024-10-15 13:25:36 +0100 |
|---|---|---|
| committer | Daniel P. Berrangé <berrange@redhat.com> | 2024-10-22 11:44:23 +0100 |
| commit | dde538c9a76f328a92c532893e97e18785d57364 (patch) | |
| tree | 9672a4c5ebf610bfe20731adaba59df44c2c91ae /crypto/hash-nettle.c | |
| parent | b5b89e9bc6a20677ff59e5049ba6b89a68105b5e (diff) | |
| download | focaccia-qemu-dde538c9a76f328a92c532893e97e18785d57364.tar.gz focaccia-qemu-dde538c9a76f328a92c532893e97e18785d57364.zip | |
crypto/hash: avoid overwriting user supplied result pointer
If the user provides a pre-allocated buffer for the hash result, we must use that rather than re-allocating a new buffer. Reported-by: Dorjoy Chowdhury <dorjoychy111@gmail.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Diffstat (limited to 'crypto/hash-nettle.c')
| -rw-r--r-- | crypto/hash-nettle.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/crypto/hash-nettle.c b/crypto/hash-nettle.c index 3b847aa60e..c78624b347 100644 --- a/crypto/hash-nettle.c +++ b/crypto/hash-nettle.c @@ -150,9 +150,17 @@ int qcrypto_nettle_hash_finalize(QCryptoHash *hash, Error **errp) { union qcrypto_hash_ctx *ctx = hash->opaque; - - *result_len = qcrypto_hash_alg_map[hash->alg].len; - *result = g_new(uint8_t, *result_len); + int ret = qcrypto_hash_alg_map[hash->alg].len; + + if (*result_len == 0) { + *result_len = ret; + *result = g_new(uint8_t, *result_len); + } else if (*result_len != ret) { + error_setg(errp, + "Result buffer size %zu is smaller than hash %d", + *result_len, ret); + return -1; + } qcrypto_hash_alg_map[hash->alg].result(ctx, *result_len, *result); |