[src/trunk]: src/sys/opencrypto Avoid another userland-controlled integer ove...

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/2825aa9ae612
branches:  trunk
changeset: 825716:2825aa9ae612
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Fri Jul 28 17:14:04 2017 +0000

description:
Avoid another userland-controlled integer overflow.

>From Ilja Van Sprundel.

diffstat:

 sys/opencrypto/ocryptodev.c |  9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diffs (30 lines):

diff -r 454bcd8fd7a1 -r 2825aa9ae612 sys/opencrypto/ocryptodev.c
--- a/sys/opencrypto/ocryptodev.c       Fri Jul 28 16:57:12 2017 +0000
+++ b/sys/opencrypto/ocryptodev.c       Fri Jul 28 17:14:04 2017 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: ocryptodev.c,v 1.10 2017/07/28 14:16:29 riastradh Exp $ */
+/*     $NetBSD: ocryptodev.c,v 1.11 2017/07/28 17:14:04 riastradh Exp $ */
 /*     $FreeBSD: src/sys/opencrypto/cryptodev.c,v 1.4.2.4 2003/06/03 00:09:02 sam Exp $        */
 /*     $OpenBSD: cryptodev.c,v 1.53 2002/07/10 22:21:30 mickey Exp $   */
 
@@ -69,7 +69,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.10 2017/07/28 14:16:29 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ocryptodev.c,v 1.11 2017/07/28 17:14:04 riastradh Exp $");
 
 #include <sys/param.h>
 #include <sys/systm.h>
@@ -127,6 +127,11 @@
                break;
        case CIOCNGSESSION:
                osgop = (struct ocrypt_sgop *)data;
+               if ((osgop->count <= 0) ||
+                   (SIZE_MAX/sizeof(struct osession_n_op) < osgop->count)) {
+                       error = EINVAL;
+                       break;
+               }
                osnop = kmem_alloc((osgop->count *
                                  sizeof(struct osession_n_op)), KM_SLEEP);
                error = copyin(osgop->sessions, osnop, osgop->count *