dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

[IPSEC]: Avoid undefined shift operation when testing algorithm ID 

The aalgos/ealgos fields are only 32 bits wide.  However, af_key tries
to test them with the expression 1 << id where id can be as large as
253.  This produces different behaviour on different architectures.

The following patch explicitly checks whether ID is greater than 31
and fails the check if that's the case.

We cannot easily extend the mask to be longer than 32 bits due to
exposure to user-space.  Besides, this whole interface is obsolete
anyway in favour of the xfrm_user interface which doesn't use this
bit mask in templates (well not within the kernel anyway).

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu 2007-12-19 23:44:29 -08:00 committed by David S. Miller
parent e0260feddf
commit f398035f2d
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/key/af_key.c
View File

@ -2784,12 +2784,22 @@ static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp)
static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
{
return t->aalgos & (1 << d->desc.sadb_alg_id);
unsigned int id = d->desc.sadb_alg_id;
if (id >= sizeof(t->aalgos) * 8)
return 0;
return (t->aalgos >> id) & 1;
}
static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
{
return t->ealgos & (1 << d->desc.sadb_alg_id);
unsigned int id = d->desc.sadb_alg_id;
if (id >= sizeof(t->ealgos) * 8)
return 0;
return (t->ealgos >> id) & 1;
}
static int count_ah_combs(struct xfrm_tmpl *t)