From: Remi Tricot-Le Breton Date: Wed, 30 Sep 2026 08:27:12 +0000 (+0200) Subject: BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5 X-Git-Tag: v3.5-dev8~90 X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=623789ef276986795f1fdfb2b8e523a349a3acb7;p=haproxy.git BUG/MINOR: jwe: Buffer overflow when filling fake cek in case of RSA1.5 In commit 1a5a333 "BUG/MEDIUM: jwe: substitute random CEK on RSA1_5 decryption failure per RFC 7516 #11.5" we fill a fake CEK with random data to avoid timing attacks. But the loop that fills the buffer does is 8 bytes at a time but the index was not properly incremented which could result in a buffer overflow if the "struct buffer" size was too short. This issue was found by Dmitri Kaslov. This patch should be backported to 3.4. --- diff --git a/src/jwe.c b/src/jwe.c index 3593ffb61..9c0e69f31 100644 --- a/src/jwe.c +++ b/src/jwe.c @@ -847,15 +847,12 @@ static int do_decrypt_cek_rsa(struct buffer *cek, struct buffer *decrypted_cek, int i; unsigned char *p = (unsigned char *)b_orig(decrypted_cek); - /* fill 8 bytes at a time */ - for (i = 0; i <= MAX_DECRYPTED_CEK_LEN - 8; i++) { + /* fill 8 bytes at a time in a 64 bytes buffer */ + for (i = 0; i < MAX_DECRYPTED_CEK_LEN; i += 8) { uint64_t r = ha_random64(); memcpy(p, &r, 8); p += 8; } - /* complete if not multiple of 8 (normally not the case) */ - for (; i < MAX_DECRYPTED_CEK_LEN; i++) - *(p++) = ha_random64(); outl = MAX_DECRYPTED_CEK_LEN; } else