From 79fc1be3bee9c8dadfbe5f47f4d93c8cf14a831d Mon Sep 17 00:00:00 2001 From: Rahul Rai Date: Sat, 15 Aug 2026 15:10:35 +0530 Subject: [PATCH] pkcs11: bound the config file index in pkcs11_config_load_objects() updateConfFileData[] holds MAX_CONF_FILES entries but the index i is never compared against it. A filestore with 17 .conf files stores past the end at :1083; with 16 the array is full, leaving no NULL for the walks at :1114 and :1365, which then read past it. Bound the store and report CKR_HOST_MEMORY rather than dropping files, since which files got dropped would depend on readdir() order. Bound both walks by totalConfFileCount, and increment i only when the allocation succeeded so the two cannot disagree. Co-Authored-By: Claude Opus 5 --- lib/pkcs11/pkcs11_config.c | 35 +++++++++++++++++++++++------------ 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/lib/pkcs11/pkcs11_config.c b/lib/pkcs11/pkcs11_config.c index 952688ec..252c10a1 100644 --- a/lib/pkcs11/pkcs11_config.c +++ b/lib/pkcs11/pkcs11_config.c @@ -1078,21 +1078,32 @@ CK_RV pkcs11_config_load_objects(pkcs11_slot_ctx_ptr slot_ctx) /* Configuration files must end with ".conf" */ if (0 == strcmp(&de->d_name[fn_len - 5u], ".conf")) { - /* coverity[misra_c_2012_directive_4_12_violation] Standard library functions are required */ - /* coverity[misra_c_2012_rule_21_3_violation] Standard library functions are required */ - updateConfFileData[i] = (pkcs11_conf_filedata*)malloc(sizeof(pkcs11_conf_filedata)); - - if (NULL != updateConfFileData[i]) + if (MAX_CONF_FILES <= i) + { + /* More configuration files than updateConfFileData + can hold. Report it rather than silently ignoring + the remainder, which files get ignored would + otherwise depend on readdir() order. */ + rv = CKR_HOST_MEMORY; + } + else { - (void)strcpy(updateConfFileData[i]->filename, de->d_name); - updateConfFileData[i]->initialized = false; + /* coverity[misra_c_2012_directive_4_12_violation] Standard library functions are required */ + /* coverity[misra_c_2012_rule_21_3_violation] Standard library functions are required */ + updateConfFileData[i] = (pkcs11_conf_filedata*)malloc(sizeof(pkcs11_conf_filedata)); - if (UINT8_MAX > totalConfFileCount) + if (NULL != updateConfFileData[i]) { - totalConfFileCount++; + (void)strcpy(updateConfFileData[i]->filename, de->d_name); + updateConfFileData[i]->initialized = false; + + if (UINT8_MAX > totalConfFileCount) + { + totalConfFileCount++; + } + i++; } } - i++; } } } @@ -1111,7 +1122,7 @@ CK_RV pkcs11_config_load_objects(pkcs11_slot_ctx_ptr slot_ctx) argc = sizeof(argv) / sizeof(argv[0]); /* First parse base file and then parse handle files if present*/ - while (NULL != updateConfFileData[i]) + while ((totalConfFileCount > i) && (NULL != updateConfFileData[i])) { size_t fileName_len = strlen(updateConfFileData[i]->filename); (void)memcpy((void*)fileName_tmp, (const void*)updateConfFileData[i]->filename, sizeof(updateConfFileData[i]->filename)); @@ -1362,7 +1373,7 @@ CK_RV pkcs11_config_load_objects(pkcs11_slot_ctx_ptr slot_ctx) i++; } - for (i = 0; NULL != updateConfFileData[i]; i++) + for (i = 0; (totalConfFileCount > i) && (NULL != updateConfFileData[i]); i++) { pkcs11_os_free(updateConfFileData[i]); }