Repository navigation
Conversation
decrypt() computed body_len/pt_len as int from a size_t length, guarded the
receive-buffer bounds with assert() (compiled out under -DNDEBUG), and killed
the process with exit(1) if pt_len went negative. The invariant it depends on
-- pt_len must never equal ae_decrypt()'s AE_INVALID (-1) sentinel, or a
forged packet would be accepted -- held only by luck of the caller.
Rework:
- reject len < 24 (throws, not exit()),
- compute body_len/pt_len in size_t (no narrowing, no overflow),
- reject body_len/pt_len that would not fit the fixed receive buffers
(bounding by ciphertext_buffer/plaintext_buffer, which is the real
constraint: encrypt() can legitimately produce up to RECEIVE_MTU + 8
bytes for a maximum-size message).
len >= 24 guarantees pt_len >= 0, so it never collides with AE_INVALID. No
behavior change on the network path; decrypt() is now safe for any caller and
never exit()s.
Checks that decrypt() rejects out-of-range lengths (0, 1, 23, and beyond the receive buffer) with a CryptoException rather than an abort/exit, that a tampered ciphertext fails the integrity check (the property the pt_len >= 0 invariant protects), and that minimum-length (24-byte, empty payload) and normal round-trips both succeed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
decrypt() narrowed size_t to int, guarded buffer bounds only with assert(), and called exit(1) on a negative length. It now rejects bad lengths with a CryptoException and uses size_t arithmetic throughout. No change on the network path.
Test:
decrypt-bounds.