yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-04-19 12:32:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix missing bound check

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2014-11-25 17:41:50 +01:00
parent aa02dc1ed8
commit 258bab0b1b
3 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ChangeLog
View file

@ -18,6 +18,8 @@ Security
Bugfix
* Fix potential undefined behaviour in Camellia.
* Fix memory leaks in PKCS#5 and PKCS#12.
* Stack buffer overflow if ctr_drbg_update() is called with too large
add_len (found by Jean-Philippe Aumasson) (not triggerable remotely).
Changes
* Blind RSA private operations even when POLARSSL_RSA_NO_CRT is defined.

4
include/polarssl/ctr_drbg.h
View file

@ -154,6 +154,10 @@ int ctr_drbg_reseed( ctr_drbg_context *ctx,
* \param ctx CTR_DRBG context
* \param additional Additional data to update state with
* \param add_len Length of additional data
*
* \note If add_len is greater than CTR_DRBG_MAX_SEED_INPUT,
* only the first CTR_DRBG_MAX_SEED_INPUT bytes are used,
* the remaining ones are silently discarded.
*/
void ctr_drbg_update( ctr_drbg_context *ctx,
const unsigned char *additional, size_t add_len );

8
library/ctr_drbg.c
View file

@ -118,6 +118,9 @@ static int block_cipher_df( unsigned char *output,
int i, j, buf_len, use_len;
if( data_len > CTR_DRBG_MAX_SEED_INPUT )
return( POLARSSL_ERR_CTR_DRBG_INPUT_TOO_BIG );
memset( buf, 0, CTR_DRBG_MAX_SEED_INPUT + CTR_DRBG_BLOCKSIZE + 16 );
/*
@ -233,6 +236,11 @@ void ctr_drbg_update( ctr_drbg_context *ctx,
if( add_len > 0 )
{
/* MAX_INPUT would be more logical here, but we have to match
* block_cipher_df()'s limits since we can't propagate errors */
if( add_len > CTR_DRBG_MAX_SEED_INPUT )
add_len = CTR_DRBG_MAX_SEED_INPUT;
block_cipher_df( add_input, additional, add_len );
ctr_drbg_update_internal( ctx, add_input );
}