diff options
| author | Andy Polyakov <appro@openssl.org> | 2017-01-19 00:20:49 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2017-01-26 10:54:01 +0000 |
| commit | 2198b3a55de681e1f3c23edb0586afe13f438051 (patch) | |
| tree | 8db94da0ed2bd6354ba723fc5dc491ad8dd7b614 /crypto/evp/e_chacha20_poly1305.c | |
| parent | 8e20499629b6bcf868d0072c7011e590b5c2294d (diff) | |
| download | openssl-2198b3a55de681e1f3c23edb0586afe13f438051.tar.gz | |
crypto/evp: harden AEAD ciphers.
Originally a crash in 32-bit build was reported CHACHA20-POLY1305
cipher. The crash is triggered by truncated packet and is result
of excessive hashing to the edge of accessible memory. Since hash
operation is read-only it is not considered to be exploitable
beyond a DoS condition. Other ciphers were hardened.
Thanks to Robert Święcki for report.
CVE-2017-3731
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'crypto/evp/e_chacha20_poly1305.c')
| -rw-r--r-- | crypto/evp/e_chacha20_poly1305.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/crypto/evp/e_chacha20_poly1305.c b/crypto/evp/e_chacha20_poly1305.c index befd805e35..46bc2cb44f 100644 --- a/crypto/evp/e_chacha20_poly1305.c +++ b/crypto/evp/e_chacha20_poly1305.c @@ -398,6 +398,8 @@ static int chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, len = aad[EVP_AEAD_TLS1_AAD_LEN - 2] << 8 | aad[EVP_AEAD_TLS1_AAD_LEN - 1]; if (!ctx->encrypt) { + if (len < POLY1305_BLOCK_SIZE) + return 0; len -= POLY1305_BLOCK_SIZE; /* discount attached tag */ memcpy(temp, aad, EVP_AEAD_TLS1_AAD_LEN - 2); aad = temp; @@ -407,8 +409,7 @@ static int chacha20_poly1305_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg, actx->tls_payload_length = len; /* - * merge record sequence number as per - * draft-ietf-tls-chacha20-poly1305-03 + * merge record sequence number as per RFC7905 */ actx->key.counter[1] = actx->nonce[0]; actx->key.counter[2] = actx->nonce[1] ^ CHACHA_U8TOU32(aad); |