j3d1/bearssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fixed buffer overrun (read only, usually harmless, but sloppy nonetheless).

Browse source
This commit is contained in:
Thomas Pornin 2016-11-29 16:03:49 +01:00
parent 298ce6530e
commit 93185df1e7
4 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/symcipher/aes_ct64.c
View file

@ -378,7 +378,7 @@ br_aes_ct64_skey_expand(uint64_t *skey,
{ {
unsigned u, v, n; unsigned u, v, n;
n = (num_rounds + 1) << 2; n = (num_rounds + 1) << 1;
for (u = 0, v = 0; u < n; u ++, v += 4) { for (u = 0, v = 0; u < n; u ++, v += 4) {
uint64_t x0, x1, x2, x3; uint64_t x0, x1, x2, x3;

2
src/symcipher/aes_ct64_cbcdec.c
View file

@ -39,7 +39,7 @@ br_aes_ct64_cbcdec_run(const br_aes_ct64_cbcdec_keys *ctx,
void *iv, void *data, size_t len) void *iv, void *data, size_t len)
{ {
unsigned char *buf; unsigned char *buf;
uint64_t sk_exp[240]; uint64_t sk_exp[120];
uint32_t ivw[4]; uint32_t ivw[4];
br_aes_ct64_skey_expand(sk_exp, ctx->num_rounds, ctx->skey); br_aes_ct64_skey_expand(sk_exp, ctx->num_rounds, ctx->skey);

2
src/symcipher/aes_ct64_cbcenc.c
View file

@ -39,7 +39,7 @@ br_aes_ct64_cbcenc_run(const br_aes_ct64_cbcenc_keys *ctx,
void *iv, void *data, size_t len) void *iv, void *data, size_t len)
{ {
unsigned char *buf; unsigned char *buf;
uint64_t sk_exp[240]; uint64_t sk_exp[120];
uint32_t ivw[4]; uint32_t ivw[4];
br_aes_ct64_skey_expand(sk_exp, ctx->num_rounds, ctx->skey); br_aes_ct64_skey_expand(sk_exp, ctx->num_rounds, ctx->skey);

2
src/symcipher/aes_ct64_ctr.c
View file

@ -53,7 +53,7 @@ br_aes_ct64_ctr_run(const br_aes_ct64_ctr_keys *ctx,
{ {
unsigned char *buf; unsigned char *buf;
uint32_t ivw[16]; uint32_t ivw[16];
uint64_t sk_exp[240]; uint64_t sk_exp[120];
br_aes_ct64_skey_expand(sk_exp, ctx->num_rounds, ctx->skey); br_aes_ct64_skey_expand(sk_exp, ctx->num_rounds, ctx->skey);
br_range_dec32le(ivw, 3, iv); br_range_dec32le(ivw, 3, iv);