mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-04 23:08:39 +09:00
Check for integer overflow in AesTask::DoCrypto() (DiD)
After calling mResult.SetLength(mData.Length() + 16) we should check that the integer addition didn't overflow. It seems at the moment impossible to create ArrayBuffers of size >= 0x0xfffffff0, however adding a check here doesn't hurt. mResult.Length() is passed to the PK11 API functions as a maxOut parameter and should be checked by the softoken crypto algorithm implementations. AES-ECB and AES-GCM seem to do that correctly.
This commit is contained in:
parent
d1abf0f6d8
commit
b67e03dc90
1 changed files with 5 additions and 0 deletions
|
|
@ -716,6 +716,11 @@ private:
|
|||
return NS_ERROR_DOM_INVALID_ACCESS_ERR;
|
||||
}
|
||||
|
||||
// Check whether the integer addition would overflow.
|
||||
if (std::numeric_limits<CryptoBuffer::size_type>::max() - 16 < mData.Length()) {
|
||||
return NS_ERROR_DOM_DATA_ERR;
|
||||
}
|
||||
|
||||
// Initialize the output buffer (enough space for padding / a full tag)
|
||||
uint32_t dataLen = mData.Length();
|
||||
uint32_t maxLen = dataLen + 16;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue