diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2021-11-16 14:16:16 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2021-11-23 14:33:38 +0000 |
| commit | 83d0a7763a92b893875548812d2a3aea651e971f (patch) | |
| tree | 1671811ec43c1958a2b86fa5b8195056a636e9b3 | |
| parent | 0ed191d116f511c1e67338f05386d87aad53076f (diff) | |
aesni: Avoid a potential out-of-bounds load in AES_GCM_encrypt()
Reported by: Jenkins (KASAN job)
Reviewed by: cem, jhb
Sponsored by: The FreeBSD Foundation
(cherry picked from commit 4285655adb7480336857bf8e051365d73db18011)
| -rw-r--r-- | sys/crypto/aesni/aesni_ghash.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/sys/crypto/aesni/aesni_ghash.c b/sys/crypto/aesni/aesni_ghash.c index b0d1b6137ec6..a1295b6ccbda 100644 --- a/sys/crypto/aesni/aesni_ghash.c +++ b/sys/crypto/aesni/aesni_ghash.c @@ -504,9 +504,10 @@ AES_GCM_encrypt(const unsigned char *in, unsigned char *out, } tmp1 = _mm_aesenc_si128(tmp1, KEY[nr-1]); tmp1 = _mm_aesenclast_si128(tmp1, KEY[nr]); - tmp1 = _mm_xor_si128(tmp1, - _mm_loadu_si128(&((const __m128i *)in)[k])); - last_block = tmp1; + last_block = _mm_setzero_si128(); + memcpy(&last_block, &((const __m128i *)in)[k], + nbytes % 16); + last_block = _mm_xor_si128(last_block, tmp1); for (j=0; j<nbytes%16; j++) out[k*16+j] = ((unsigned char*)&last_block)[j]; for ((void)j; j<16; j++) |