From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Wed, 30 Sep 2026 08:27:13 +0000 (+0200)
Subject: BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)
X-Git-Tag: v3.5-dev8~89
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=29ac6640eaf013086a492c1ab65f648e4098e57e;p=haproxy.git

BUG/MINOR: jwe: Avoid buffer overflow in fake cek (RSA1.5)

In commit 1a5a333 "BUG/MEDIUM: jwe: substitute random CEK on RSA1_5
decryption failure per RFC 7516 #11.5" we fill a fake CEK with random
data to avoid timing attacks but the size of the buffer was never
checked. If we happened to have a too little bufsize (less than 64
bytes) we could have out of bounds accesses.

This issue was found by Dmitri Kaslov.

This patch should be backported to 3.4.
---

diff --git a/src/jwe.c b/src/jwe.c
index 9c0e69f31..b16ba4133 100644
--- a/src/jwe.c
+++ b/src/jwe.c
@@ -847,6 +847,9 @@ static int do_decrypt_cek_rsa(struct buffer *cek, struct buffer *decrypted_cek,
 			int i;
 			unsigned char *p = (unsigned char *)b_orig(decrypted_cek);
 
+			if (b_size(decrypted_cek) < MAX_DECRYPTED_CEK_LEN)
+				goto end;
+
 			/* fill 8 bytes at a time in a 64 bytes buffer */
 			for (i = 0; i < MAX_DECRYPTED_CEK_LEN; i += 8) {
 				uint64_t r = ha_random64();