GeezerVison is showing github.com — crypto: fix CipherBase Update int32 overflow · nodejs/node@2fbf956
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: src/crypto/crypto_cipher.cc +5-1Lines changed: 5 additions & 1 deletion | Original file line number | Diff line number | Diff line change |
|---|
@@ -803,7 +803,11 @@ CipherBase::UpdateResult CipherBase::Update( |
803 | 803 | if (kind_ == kDecipher && IsAuthenticatedMode()) |
804 | 804 | CHECK(MaybePassAuthTagToOpenSSL()); |
805 | 805 |
|
806 | | - int buf_len = len + EVP_CIPHER_CTX_block_size(ctx_.get()); |
| 806 | + const int block_size = EVP_CIPHER_CTX_block_size(ctx_.get()); |
| 807 | + CHECK_GT(block_size, 0); |
| 808 | + if (len + block_size > INT_MAX) return kErrorState; |
| 809 | + int buf_len = len + block_size; |
| 810 | + |
807 | 811 | // For key wrapping algorithms, get output size by calling |
808 | 812 | // EVP_CipherUpdate() with null output. |
809 | 813 | if (kind_ == kCipher && mode == EVP_CIPH_WRAP_MODE && |
|
Collapse file
Copy file name to clipboardExpand all lines: test/parallel/test-crypto-cipheriv-decipheriv.js +8Lines changed: 8 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -215,3 +215,11 @@ for (let n = minIvLength; n < maxIvLength; n += 1) { |
215 | 215 | () => crypto.createCipheriv('aes-128-ecb', Buffer.alloc(17), null), |
216 | 216 | /Invalid key length/); |
217 | 217 | } |
| 218 | + |
| 219 | +{ |
| 220 | + // https://github.com/nodejs/node/issues/45757 |
| 221 | + // eslint-disable-next-line no-restricted-syntax |
| 222 | + assert.throws(() => |
| 223 | + crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(12)) |
| 224 | + .update(Buffer.allocUnsafeSlow(2 ** 31 - 1))); |
| 225 | +} |