diff options
| author | John Baldwin <jhb@FreeBSD.org> | 2026-06-30 18:11:29 +0000 |
|---|---|---|
| committer | John Baldwin <jhb@FreeBSD.org> | 2026-06-30 18:11:29 +0000 |
| commit | 1756d1cab3ce28085eec94a45c557e1af265ccd0 (patch) | |
| tree | 62bb21968057c38e7662d2fec9af4676d1c90ef3 | |
| parent | 150df709c28ca10a7ccec02482441257ec9c13da (diff) | |
ktls CBC decrypt: Avoid creating zero length iovec entries
If an mbuf's length in the chain for an encrypted TLS record exactly
matches the remaining length of header bytes to skip, skip the mbuf
entirely rather than adding a zero-length iovec entry.
Sponsored by: Chelsio Communications
| -rw-r--r-- | sys/opencrypto/ktls_ocf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/opencrypto/ktls_ocf.c b/sys/opencrypto/ktls_ocf.c index 87cbf0bd3311..81e130258747 100644 --- a/sys/opencrypto/ktls_ocf.c +++ b/sys/opencrypto/ktls_ocf.c @@ -500,7 +500,7 @@ ktls_ocf_tls_cbc_decrypt(struct ktls_session *tls, iov[0].iov_len = sizeof(ad); skip = sizeof(*hdr) + AES_BLOCK_LEN; for (i = 1, n = m; n != NULL; n = n->m_next) { - if (n->m_len < skip) { + if (n->m_len <= skip) { skip -= n->m_len; continue; } |