Repository navigation
Return early from OAEP Unpad on undersized blocks - #1374
Open
Coralesoft wants to merge 1 commit into
Open
Coralesoft wants to merge 1 commit into
Coralesoft wants to merge 1 commit into
Conversation
OAEP_Base::Unpad set the invalid flag for a block too small to hold an encoding but continued to lay it out, reading past the block before the flag was checked. Return before the layout instead. Tighten the Pad bound to the full 2*hLen+1 minimum and write the input-length check as a subtraction so a large inputLength cannot overflow it. Move the invariant assertion after the throw so debug and release builds agree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #1370, follow-up to 3269c25.
OAEP_Base::Unpadmarks undersized blocks invalid but continues through masking and digest verification before returning. The saturating subtraction preventsdbLenfrom wrapping, but these later accesses can still read past the block.Reproduced under AddressSanitizer through the public
TF_DecryptorBase::Decryptpath:xorbufcrosses the allocation boundary by one byte.VerifyBufsEqualcrosses the allocation boundary by one byte.Unpadnow returns an invalid decoding when the internal block is smaller than2*hLen+1, before setting up the seed and DB buffers or masking. The check depends only on the block length and hash choice.Padapplies the matching bound and checks the input length by subtraction to avoid overflow. The assertion follows the runtime check so invalid sizes throw in debug builds too.Verified locally with GCC 13 and -O1 -fsanitize=address: both decrypt cases return an invalid decoding with no sanitizer reports after the change. cryptest v passes with no sanitizer reports, and cryptest tv rsa_oaep passes all tests.