Check for integer overflow in AesTask::DoCrypto() (DiD)

After calling mResult.SetLength(mData.Length() + 16) we should check
that the integer addition didn't overflow. It seems at the moment
impossible to create ArrayBuffers of size >= 0x0xfffffff0, however
adding a check here doesn't hurt.

mResult.Length() is passed to the PK11 API functions as a
maxOut parameter and should be checked by the
softoken crypto algorithm implementations.
AES-ECB and AES-GCM seem to do that correctly.
This commit is contained in:
wolfbeast 2018-01-28 10:25:49 +01:00 committed by Roy Tam
commit b67e03dc90

View file

@ -716,6 +716,11 @@ private:
return NS_ERROR_DOM_INVALID_ACCESS_ERR;
}
// Check whether the integer addition would overflow.
if (std::numeric_limits<CryptoBuffer::size_type>::max() - 16 < mData.Length()) {
return NS_ERROR_DOM_DATA_ERR;
}
// Initialize the output buffer (enough space for padding / a full tag)
uint32_t dataLen = mData.Length();
uint32_t maxLen = dataLen + 16;