Re: [PATCH v4] scsi: target: iscsi: validate CHAP_R length before base64 decode

On Thu, 21 May 2026 17:11:21 +0200, Alexandru Hossu wrote:

> chap_server_compute_hash() allocates client_digest as
> kzalloc(chap->digest_size) and then, for BASE64-encoded responses,
> passes chap_r directly to chap_base64_decode() without checking whether
> the input length could produce more than digest_size bytes of output.
> 
> chap_base64_decode() writes to the destination unconditionally as long
> as there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and
> the "0b" prefix stripped by extract_param(), up to 127 base64 characters
> can reach the decoder. 127 characters decode to 95 bytes. For SHA-256
> (digest_size=32) this overflows client_digest by 63 bytes; for MD5
> (digest_size=16) the overflow is 79 bytes.
> 
> [...]

Applied to 7.1/scsi-fixes, thanks!

[1/1] scsi: target: iscsi: validate CHAP_R length before base64 decode
      https://git.kernel.org/mkp/scsi/c/85db7391310b

-- 
Martin K. Petersen