opencrypto: Handle end-of-cursor conditions in crypto_cursor_segment()

[markj]

Summary

Some consumers, e.g., swcr_encdec(), may call crypto_cursor_segment()
after having advanced the cursor to the end of the buffer. In this case
I believe the right behaviour is to return NULL and a length of 0.

When this occurs with a CRYPTO_BUF_VMPAGE buffer, the cc_vmpage pointer
will point past the end of the page pointer array, so
crypto_cursor_segment() ends up dereferencing a random pointer before
the function returns a length of 0. I believe the uio-backed cursor has
a similar problem.

Fix the problem by checking cc_buf_len before doing anything else.

PR: 271766

[markj]

This isn't quite right, some cursor types don't maintain cc_buf_len.

[markj]

Maintain cc_buf_len for uio cursors; keep the existing check for mbuf cursors.

[olce]

sys/opencrypto/criov.c

525

Typo?

[markj]

Fix a typo.

[markj]

sys/opencrypto/criov.c

525

Indeed, thank you.

[jhb]

Humm, I had originally considered this a break of the API contract FWIW that callers shouldn't try to use a cursor after advancing past the end (though perhaps I broke that contract myself). Hmm, reading swcr_encdec, it might indeed be a bit annoying to avoid calling crypto_cursor_segment for this case.