yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-12-23 09:55:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3772 from frestr/bugfix/ccm_add_length

Browse source 
Fix additional data length field check for CCM
This commit is contained in:
Gilles Peskine 2020-10-21 22:31:48 +02:00 committed by GitHub
parent 176fca03b4 5e940c6068
commit 1b275cc5d0
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 8 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog.d/fix_ccm_add_length_check.txt Normal file
View file

@ -0,0 +1,5 @@
Bugfix
* Fix an off-by-one error in the additional data length check for
CCM, which allowed encryption with a non-standard length field.
Fixes #3719.

2
library/ccm.c
View file

@ -175,7 +175,7 @@ static int ccm_auth_crypt( mbedtls_ccm_context *ctx, int mode, size_t length,
if( iv_len < 7 || iv_len > 13 )
return( MBEDTLS_ERR_CCM_BAD_INPUT );
if( add_len > 0xFF00 )
if( add_len >= 0xFF00 )
return( MBEDTLS_ERR_CCM_BAD_INPUT );
q = 16 - 1 - (unsigned char) iv_len;

4
tests/suites/test_suite_ccm.data
View file

@ -41,9 +41,9 @@ ccm_lengths:5:10:5:18:MBEDTLS_ERR_CCM_BAD_INPUT
CCM lengths #6 tag length not even
ccm_lengths:5:10:5:7:MBEDTLS_ERR_CCM_BAD_INPUT
CCM lengths #7 AD too long (2^16 - 2^8 + 1)
CCM lengths #7 AD too long (2^16 - 2^8)
depends_on:!MBEDTLS_CCM_ALT
ccm_lengths:5:10:65281:8:MBEDTLS_ERR_CCM_BAD_INPUT
ccm_lengths:5:10:65280:8:MBEDTLS_ERR_CCM_BAD_INPUT
CCM lengths #8 msg too long for this IV length (2^16, q = 2)
ccm_lengths:65536:13:5:8:MBEDTLS_ERR_CCM_BAD_INPUT