Browse Source

MT#55283 Ensure copy pointer don't leak memory

closes #1870

Change-Id: I18a48d2e80872ccc8a0b52a13dbc23b82d1981cb
(cherry picked from commit d728233e29)
(cherry picked from commit f0198fe58d)
mr12.5.1
Alexandru Pirvulescu 1 year ago
committed by Richard Fuchs
parent
commit
54568f534d
1 changed files with 11 additions and 3 deletions
  1. +11
    -3
      kernel-module/xt_RTPENGINE.c

+ 11
- 3
kernel-module/xt_RTPENGINE.c View File

@ -5743,17 +5743,25 @@ static int srtp_decrypt_aes_gcm(struct re_crypto_context *c,
iv.seq ^= htons(pkt_idx & 0x00ffffULL);
req = aead_request_alloc(c->aead, GFP_ATOMIC);
if (!req)
if (!req) {
if (copy)
kfree(copy);
return -ENOMEM;
if (IS_ERR(req))
}
if (IS_ERR(req)) {
if (copy)
kfree(copy);
return PTR_ERR(req);
}
sg_init_table(sg, ARRAY_SIZE(sg));
sg_set_buf(&sg[0], r->rtp_header, r->header_len);
sg_set_buf(&sg[1], r->payload, r->payload_len);
// make copy of payload in case the decyption clobbers it
copy = kmalloc(r->payload_len, GFP_ATOMIC);
if (!copy)
copy = kmalloc(r->payload_len, GFP_ATOMIC);
if (copy)
memcpy(copy, r->payload, r->payload_len);


Loading…
Cancel
Save