Thomas Haller 77ae25aad1 xfrm: fix memory corruption (dangling pointer) when when setting xfrmnl_sa ... The follow leaves a dangling pointer when the name argument is too long: xfrmnl_sa_set_aead_params: if (sa->aead) free (sa->aead); if ( strlen (alg_name) >= sizeof (sa->aead->alg_name) || (sa->aead = calloc (1, newlen)) == NULL) return -1; Fix that, but do more: - ensure that we don't modify the object when the setter is going to fail. That means, first check whether we can succeed with all the steps that are requested, and (in case we cannot) fail without modifing the target object. - bonus points for making the setter self-assignment safe by reordering the setting and freeing of the memory.		2019-08-09 16:48:55 +02:00
..
ae.c	lib/xfrm/ae.c: fix memcpy(dst, dst) bug	2017-06-15 18:00:14 +02:00
lifetime.c	xfrm/lifetime: Include own public header for function prototypes	2017-01-20 09:38:11 +01:00
sa.c	xfrm: fix memory corruption (dangling pointer) when when setting xfrmnl_sa	2019-08-09 16:48:55 +02:00
selector.c	xfrm/selector: Include own public header for function prototypes	2017-01-20 09:38:11 +01:00
sp.c	xfrm: NUL terminate the ctx_str buffer in xfrmnl_sa_set_sec_ctx()	2017-02-27 17:39:54 +01:00
template.c	xfrm/template: Include own public header for function prototypes	2017-01-20 09:38:11 +01:00