BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5

In commit 1a5a333 "BUG/MEDIUM: jwe: substitute random CEK on RSA1_5
decryption failure per RFC 7516 #11.5" we fill a fake CEK with random
data to avoid timing attacks. But the loop that fills the buffer does is
8 bytes at a time but the index was not properly incremented which could
result in a buffer overflow if the "struct buffer" size was too short.

This issue was found by Dmitri Kaslov.

This patch should be backported to 3.4.

diff --git a/src/jwe.c b/src/jwe.c
index 3593ffb6120d31f8da406607c83556876edbf484..9c0e69f3132220a4564f057b9b7c8e3864502231 100644 (file)
--- a/src/jwe.c
+++ b/src/jwe.c
@@ -847,15 +847,12 @@ static int do_decrypt_cek_rsa(struct buffer *cek, struct buffer *decrypted_cek,
                        int i;
                        unsigned char *p = (unsigned char *)b_orig(decrypted_cek);
 
-                       /* fill 8 bytes at a time */
-                       for (i = 0; i <= MAX_DECRYPTED_CEK_LEN - 8; i++) {
+                       /* fill 8 bytes at a time in a 64 bytes buffer */
+                       for (i = 0; i < MAX_DECRYPTED_CEK_LEN; i += 8) {
                                uint64_t r = ha_random64();
                                memcpy(p, &r, 8);
                                p += 8;
                        }
-                       /* complete if not multiple of 8 (normally not the case) */
-                       for (; i < MAX_DECRYPTED_CEK_LEN; i++)
-                               *(p++) = ha_random64();
 
                        outl = MAX_DECRYPTED_CEK_LEN;
                } else