MT#55283 Ensure copy pointer don't leak memory

closes #1870

Change-Id: I18a48d2e80872ccc8a0b52a13dbc23b82d1981cb
(cherry picked from commit d728233e29)
mr12.5
Alexandru Pirvulescu 6 months ago committed by Richard Fuchs
parent 949c26d5b4
commit f0198fe58d

@ -5743,17 +5743,25 @@ static int srtp_decrypt_aes_gcm(struct re_crypto_context *c,
iv.seq ^= htons(pkt_idx & 0x00ffffULL);
req = aead_request_alloc(c->aead, GFP_ATOMIC);
if (!req)
if (!req) {
if (copy)
kfree(copy);
return -ENOMEM;
if (IS_ERR(req))
}
if (IS_ERR(req)) {
if (copy)
kfree(copy);
return PTR_ERR(req);
}
sg_init_table(sg, ARRAY_SIZE(sg));
sg_set_buf(&sg[0], r->rtp_header, r->header_len);
sg_set_buf(&sg[1], r->payload, r->payload_len);
// make copy of payload in case the decyption clobbers it
copy = kmalloc(r->payload_len, GFP_ATOMIC);
if (!copy)
copy = kmalloc(r->payload_len, GFP_ATOMIC);
if (copy)
memcpy(copy, r->payload, r->payload_len);

Loading…
Cancel
Save