Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential integer overflow (RiotSha1) #27

Open
DMattoon opened this issue Mar 19, 2019 · 0 comments
Open

Potential integer overflow (RiotSha1) #27

DMattoon opened this issue Mar 19, 2019 · 0 comments

Comments

@DMattoon
Copy link
Member

DMattoon commented Mar 19, 2019

Leaving this here as a reminder. SHA1 update is always called with a constant value or hardcoded size, but this should still be fixed.

typedef struct _RIOT_SHA1_CONTEXT {
sha1_quadbyte count[2];
sha1_byte buffer[64];
} RIOT_SHA1_CONTEXT;

void RIOT_SHA1_Update(RIOT_SHA1_CONTEXT *context, const char *data, unsigned int len) {
unsigned int j = (context->count[0] >> 3) & 63; //j =0..63
if ((j + len) > 63) // <--- int overflow INT_MAX + len < 63
{ do something}
else
memcpy(&context->buffer[j], &data[i], len - i); } //i = 0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant