public/qemu
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

crypto: enforce that key material doesn't overlap with LUKS header

Browse source 
We already check that key material doesn't overlap between key slots,
and that it doesn't overlap with the payload. We didn't check for
overlap with the LUKS header.

Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2022-05-10 14:35:57 +01:00
parent f1195961f3
commit 93569c3730
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
crypto/block-luks.c
View file

@ -595,6 +595,14 @@ qcrypto_block_luks_check_header(const QCryptoBlockLUKS *luks, Error **errp)
return -1;
}
if (start1 < DIV_ROUND_UP(sizeof(QCryptoBlockLUKSHeader),
QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) {
error_setg(errp,
"Keyslot %zu is overlapping with the LUKS header",
i);
return -1;
}
if (start1 + len1 > luks->header.payload_offset_sector) {
error_setg(errp,
"Keyslot %zu is overlapping with the encrypted payload",