BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)

In commit 1a5a333 "BUG/MEDIUM: jwe: substitute random CEK on RSA1_5
decryption failure per RFC 7516 #11.5" we fill a fake CEK with random
data to avoid timing attacks but the size of the buffer was never
checked. If we happened to have a too little bufsize (less than 64
bytes) we could have out of bounds accesses.

This issue was found by Dmitri Kaslov.

This patch should be backported to 3.4.

diff --git a/src/jwe.c b/src/jwe.c
index 9c0e69f3132220a4564f057b9b7c8e3864502231..b16ba4133e74f2d91afbcde83e83514ca055b191 100644 (file)
--- a/src/jwe.c
+++ b/src/jwe.c
@@ -847,6 +847,9 @@ static int do_decrypt_cek_rsa(struct buffer *cek, struct buffer *decrypted_cek,
                        int i;
                        unsigned char *p = (unsigned char *)b_orig(decrypted_cek);
 
+                       if (b_size(decrypted_cek) < MAX_DECRYPTED_CEK_LEN)
+                               goto end;
+
                        /* fill 8 bytes at a time in a 64 bytes buffer */
                        for (i = 0; i < MAX_DECRYPTED_CEK_LEN; i += 8) {
                                uint64_t r = ha_random64();