[dpdk-dev v1] crypto/openssl: fix SM2 pubkey buffer overflow in session setup

[Kai Ji]

The SM2 session setup path in openssl_set_asym_session_parameters()
copies the caller-supplied public key coordinates into a fixed 65-byte
stack buffer (1 byte uncompressed-point prefix + 32 bytes X + 32 bytes
Y) without first validating that the coordinate lengths fit.

Since xform->ec.q.x.length and xform->ec.q.y.length are generic size_t
values from the caller and are not bounds-checked before this point in
the driver, an oversized coordinate pair would overflow the pubkey[]
stack buffer before any OpenSSL API is reached.

Add a guard that rejects the xform when
1 + x.length + y.length > sizeof(pubkey), failing the session create
with the existing err_sm2 error path.

Fixes: b2fc11b6f8f1 ("crypto/openssl: support SM2 algorithm")
Cc: stable at dpdk.org

Signed-off-by: Kai Ji <kai.ji at intel.com>
---
 drivers/crypto/openssl/rte_openssl_pmd_ops.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/crypto/openssl/rte_openssl_pmd_ops.c b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
index 6133622f1b..4e5fb07bb2 100644
--- a/drivers/crypto/openssl/rte_openssl_pmd_ops.c
+++ b/drivers/crypto/openssl/rte_openssl_pmd_ops.c
@@ -1773,6 +1773,12 @@ static int openssl_set_asym_session_parameters(
 			goto err_sm2;
 		}
 
+		if (xform->ec.q.x.length >= sizeof(pubkey) ||
+				xform->ec.q.y.length >=
+				sizeof(pubkey) - xform->ec.q.x.length) {
+			OPENSSL_LOG(ERR, "SM2 public key coordinates too large");
+			goto err_sm2;
+		}
 		memset(pubkey, 0, sizeof(pubkey));
 		pubkey[0] = 0x04;
 		len += 1;
-- 
2.43.0