trusted-keys: check hex2bin result

For each hex2bin call in trusted keys, check that the ascii hex string is
valid.  On failure, return -EINVAL.

Changelog v1:
- hex2bin now returns an int

Signed-off-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Acked-by: Andy Shevchenko <andy.shevchenko@gmail.com>

diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 0c33e2ea1f3c34879d44ca57044822fefc657695..0964fc236946c0ec310c63bd9b3159583835df34 100644 (file)
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -779,7 +779,10 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
                        opt->pcrinfo_len = strlen(args[0].from) / 2;
                        if (opt->pcrinfo_len > MAX_PCRINFO_SIZE)
                                return -EINVAL;
-                       hex2bin(opt->pcrinfo, args[0].from, opt->pcrinfo_len);
+                       res = hex2bin(opt->pcrinfo, args[0].from,
+                                     opt->pcrinfo_len);
+                       if (res < 0)
+                               return -EINVAL;
                        break;
                case Opt_keyhandle:
                        res = strict_strtoul(args[0].from, 16, &handle);
@@ -791,12 +794,18 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
                case Opt_keyauth:
                        if (strlen(args[0].from) != 2 * SHA1_DIGEST_SIZE)
                                return -EINVAL;
-                       hex2bin(opt->keyauth, args[0].from, SHA1_DIGEST_SIZE);
+                       res = hex2bin(opt->keyauth, args[0].from,
+                                     SHA1_DIGEST_SIZE);
+                       if (res < 0)
+                               return -EINVAL;
                        break;
                case Opt_blobauth:
                        if (strlen(args[0].from) != 2 * SHA1_DIGEST_SIZE)
                                return -EINVAL;
-                       hex2bin(opt->blobauth, args[0].from, SHA1_DIGEST_SIZE);
+                       res = hex2bin(opt->blobauth, args[0].from,
+                                     SHA1_DIGEST_SIZE);
+                       if (res < 0)
+                               return -EINVAL;
                        break;
                case Opt_migratable:
                        if (*args[0].from == '0')
@@ -860,7 +869,9 @@ static int datablob_parse(char *datablob, struct trusted_key_payload *p,
                p->blob_len = strlen(c) / 2;
                if (p->blob_len > MAX_BLOB_SIZE)
                        return -EINVAL;
-               hex2bin(p->blob, c, p->blob_len);
+               ret = hex2bin(p->blob, c, p->blob_len);
+               if (ret < 0)
+                       return -EINVAL;
                ret = getoptions(datablob, p, o);
                if (ret < 0)
                        return ret;