Skip to content

Commit

Permalink
MT#55283 Ensure copy pointer don't leak memory
Browse files Browse the repository at this point in the history
closes #1870

Change-Id: I18a48d2e80872ccc8a0b52a13dbc23b82d1981cb
(cherry picked from commit d728233)
(cherry picked from commit f0198fe)
  • Loading branch information
Alexandru Pirvulescu authored and rfuchs committed Oct 21, 2024
1 parent 84addea commit 54568f5
Showing 1 changed file with 11 additions and 3 deletions.
14 changes: 11 additions & 3 deletions kernel-module/xt_RTPENGINE.c
Original file line number Diff line number Diff line change
Expand Up @@ -5743,17 +5743,25 @@ static int srtp_decrypt_aes_gcm(struct re_crypto_context *c,
iv.seq ^= htons(pkt_idx & 0x00ffffULL);

req = aead_request_alloc(c->aead, GFP_ATOMIC);
if (!req)
if (!req) {
if (copy)
kfree(copy);
return -ENOMEM;
if (IS_ERR(req))
}
if (IS_ERR(req)) {
if (copy)
kfree(copy);
return PTR_ERR(req);
}

sg_init_table(sg, ARRAY_SIZE(sg));
sg_set_buf(&sg[0], r->rtp_header, r->header_len);
sg_set_buf(&sg[1], r->payload, r->payload_len);

// make copy of payload in case the decyption clobbers it
copy = kmalloc(r->payload_len, GFP_ATOMIC);
if (!copy)
copy = kmalloc(r->payload_len, GFP_ATOMIC);

if (copy)
memcpy(copy, r->payload, r->payload_len);

Expand Down

0 comments on commit 54568f5

Please sign in to comment.