af_key: fix info leaks in notify messages

key_notify_sa_flush() and key_notify_policy_flush() miss to initialize the sadb_msg_reserved member of the broadcasted message and thereby leak 2 bytes of heap memory to listeners. Fix that.

Mathias Krause committed 13 years ago

Commit a5cc68f1 parent a963a371 file · +2 −0Browse files

Unified · Split

net/key/af_key.c+2−0

@@ -1710,6 +1710,7 @@ static int key_notify_sa_flush(const struct km_event *c) · 1709 unmodified lines
1710	1710	hdr->sadb_msg_version = PF_KEY_V2;
1711	1711	hdr->sadb_msg_errno = (uint8_t) 0;
1712	1712	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
	1713	+ hdr->sadb_msg_reserved = 0;
1713	1714
1714	1715	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
1715	1716
@@ -2699,6 +2700,7 @@ static int key_notify_policy_flush(const struct km_event *c) · 983 unmodified lines
2699	2700	hdr->sadb_msg_errno = (uint8_t) 0;
2700	2701	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
2701	2702	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
	2703	+ hdr->sadb_msg_reserved = 0;
2702	2704	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
2703	2705	return 0;
2704	2706