From dde538c9a76f328a92c532893e97e18785d57364 Mon Sep 17 00:00:00 2001 From: "Daniel P. Berrangé" Date: Tue, 15 Oct 2024 13:25:36 +0100 Subject: crypto/hash: avoid overwriting user supplied result pointer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If the user provides a pre-allocated buffer for the hash result, we must use that rather than re-allocating a new buffer. Reported-by: Dorjoy Chowdhury Signed-off-by: Daniel P. Berrangé --- crypto/hash-nettle.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) (limited to 'crypto/hash-nettle.c') diff --git a/crypto/hash-nettle.c b/crypto/hash-nettle.c index 3b847aa60e..c78624b347 100644 --- a/crypto/hash-nettle.c +++ b/crypto/hash-nettle.c @@ -150,9 +150,17 @@ int qcrypto_nettle_hash_finalize(QCryptoHash *hash, Error **errp) { union qcrypto_hash_ctx *ctx = hash->opaque; - - *result_len = qcrypto_hash_alg_map[hash->alg].len; - *result = g_new(uint8_t, *result_len); + int ret = qcrypto_hash_alg_map[hash->alg].len; + + if (*result_len == 0) { + *result_len = ret; + *result = g_new(uint8_t, *result_len); + } else if (*result_len != ret) { + error_setg(errp, + "Result buffer size %zu is smaller than hash %d", + *result_len, ret); + return -1; + } qcrypto_hash_alg_map[hash->alg].result(ctx, *result_len, *result); -- cgit 1.4.1