From 2962bfbf7ad843946682359d257000c6af33113b Mon Sep 17 00:00:00 2001 From: Evgeniy Gorbanyov Date: Tue, 22 Sep 2026 16:42:21 +0600 Subject: [PATCH] evmctl: reject a zero-length IMA digest field ima_ng_show() already rejects a digest field longer than the remaining template data. A zero length still passes that test: field_len - 1 wraps to UINT32_MAX and is passed to strnlen(), which reads past the template buffer. Subtracting that length from field_len can wrap as well. Require a non-zero digest field before using field_len - 1 as the strnlen() limit. strnlen() then returns at most field_len - 1, so the existing field_len - len subtraction stays in range. Signed-off-by: Evgeniy Gorbanyov --- src/evmctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/evmctl.c b/src/evmctl.c index 60bdfca..a7bd524 100644 --- a/src/evmctl.c +++ b/src/evmctl.c @@ -1736,7 +1736,7 @@ static void ima_ng_show(struct public_key_entry *public_keys, fieldp += sizeof(field_len); total_len -= sizeof(field_len); - if (total_len < field_len) { + if (field_len == 0 || total_len < field_len) { log_err("Template \"%s\" invalid template data\n", entry->name); return; }