commit 93569c373027c5c46e518e01c0c3e2d07fbb6890
author Daniel P. Berrangé <berrange@redhat.com> Tue May 10 14:35:57 2022 +0100
committer Daniel P. Berrangé <berrange@redhat.com> Thu Oct 27 12:55:27 2022 +0100
tree e9b30a5a1ef84932442eedfc666e65bb31639e9f
parent f1195961f36b19ce9008dabf11ee8362803bcd92

crypto: enforce that key material doesn't overlap with LUKS header

We already check that key material doesn't overlap between key slots,
and that it doesn't overlap with the payload. We didn't check for
overlap with the LUKS header.

Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

crypto/block-luks.c

diff --git a/crypto/block-luks.c b/crypto/block-luks.c
index 81744e2..6ef9a89 100644
--- a/crypto/block-luks.c
+++ b/crypto/block-luks.c
@@ -595,6 +595,14 @@
             return -1;
         }
 
+        if (start1 < DIV_ROUND_UP(sizeof(QCryptoBlockLUKSHeader),
+                                  QCRYPTO_BLOCK_LUKS_SECTOR_SIZE)) {
+            error_setg(errp,
+                       "Keyslot %zu is overlapping with the LUKS header",
+                       i);
+            return -1;
+        }
+
         if (start1 + len1 > luks->header.payload_offset_sector) {
             error_setg(errp,
                        "Keyslot %zu is overlapping with the encrypted payload",