crypto: marvell/cesa - fix stack smashing in marvell/hash.c
authorRussell King <rmk+kernel@arm.linux.org.uk>
Fri, 9 Oct 2015 19:43:38 +0000 (20:43 +0100)
committerHerbert Xu <herbert@gondor.apana.org.au>
Wed, 14 Oct 2015 14:23:17 +0000 (22:23 +0800)
commit9f5594c91e7cf5952ce39aff8b88c95a19a27e06
tree0e12730e589ac63e0a054779cb21a51fac5a5def
parentc4d007bcb42b3898df5ad65a513f9120ab0eccfc
crypto: marvell/cesa - fix stack smashing in marvell/hash.c

Several of the algorithms in marvell/hash.c have a statesize of zero.
When an AF_ALG accept() on an already-accepted file descriptor to
calls into hash_accept(), this causes:

char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))];

to be zero-sized, but we still pass this to:

err = crypto_ahash_export(req, state);

which proceeds to write to 'state' as if it was a "struct md5_state",
"struct sha1_state" etc.  Add the necessary initialisers for the
.statesize member.

Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
drivers/crypto/marvell/hash.c