[src/trunk]: src/sys/opencrypto Avert userland-controlled integer overflow.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/0430ebc5b28b
branches:  trunk
changeset: 355391:0430ebc5b28b
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Fri Jul 28 14:16:29 2017 +0000

description:
Avert userland-controlled integer overflow.

>From Ilja Van Sprundel.

diffstat:

 sys/opencrypto/ocryptodev.c |  9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diffs (30 lines):

diff -r 9deadf6364cf -r 0430ebc5b28b sys/opencrypto/ocryptodev.c
--- a/sys/opencrypto/ocryptodev.c       Fri Jul 28 14:13:56 2017 +0000
+++ b/sys/opencrypto/ocryptodev.c       Fri Jul 28 14:16:29 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ocryptodev.c,v 1.9 2017/07/28 14:13:56 riastradh Exp $ */
+/*     $NetBSD: ocryptodev.c,v 1.10 2017/07/28 14:16:29 riastradh Exp $ */
 /*     $FreeBSD: src/sys/opencrypto/cryptodev.c,v 1.4.2.4 2003/06/03 00:09:02 sam Exp $        */
 /*     $OpenBSD: cryptodev.c,v 1.53 2002/07/10 22:21:30 mickey Exp $   */
 
@@ -69,7 +69,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.9 2017/07/28 14:13:56 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.10 2017/07/28 14:16:29 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -159,6 +159,11 @@
                break;
        case OCIOCNCRYPTM:
                omop = (struct ocrypt_mop *)data;
+               if ((omop->count <= 0) ||
+                   (SIZE_MAX/sizeof(struct ocrypt_n_op) <= omop->count)) {
+                       error = EINVAL;
+                       break;
+               }
                ocnop = kmem_alloc((omop->count * sizeof(struct ocrypt_n_op)),
                    KM_SLEEP);
                error = copyin(omop->reqs, ocnop,