From 3a1efd9321b428fc3dcebab18ee1d3453de4cab0 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Tue, 7 May 2013 23:35:34 -0400 Subject: [PATCH] [server] fixed several (non-exploitable) overflow conditions found by Coverity --- lib/fko_encryption.c | 2 +- lib/hmac.c | 60 +++++++++++++++++++++++++++++++++----------- 2 files changed, 46 insertions(+), 16 deletions(-) diff --git a/lib/fko_encryption.c b/lib/fko_encryption.c index 4ec929d4..f9dc5990 100644 --- a/lib/fko_encryption.c +++ b/lib/fko_encryption.c @@ -84,7 +84,7 @@ _rijndael_encrypt(fko_ctx_t ctx, const char *enc_key, const int enc_key_len) if(plaintext == NULL) return(FKO_ERROR_MEMORY_ALLOCATION); - pt_len = snprintf(plaintext, pt_len+1, "%s:%s", ctx->encoded_msg, ctx->digest); + pt_len = snprintf(plaintext, pt_len, "%s:%s", ctx->encoded_msg, ctx->digest); if(! is_valid_pt_msg_len(pt_len)) return(FKO_ERROR_INVALID_DATA); diff --git a/lib/hmac.c b/lib/hmac.c index 2efa7c3f..73ae2c73 100644 --- a/lib/hmac.c +++ b/lib/hmac.c @@ -101,15 +101,21 @@ hmac_md5_init(hmac_md5_ctx *ctx, const char *key, const int key_len) { unsigned char final_key[MAX_DIGEST_BLOCK_LEN] = {0}; unsigned char init_key[MAX_DIGEST_BLOCK_LEN] = {0}; + int final_len = key_len; memset(final_key, 0x00, MAX_DIGEST_BLOCK_LEN); - memcpy(init_key, key, key_len); + memset(init_key, 0x00, MAX_DIGEST_BLOCK_LEN); - if(MD5_BLOCK_LEN < key_len) + if(key_len > MAX_DIGEST_BLOCK_LEN) + final_len = MAX_DIGEST_BLOCK_LEN; + + memcpy(init_key, key, final_len); + + if(MD5_BLOCK_LEN < final_len) { /* Calculate the digest of the key */ - md5(final_key, init_key, key_len); + md5(final_key, init_key, final_len); } else { @@ -169,15 +175,21 @@ hmac_sha1_init(hmac_sha1_ctx *ctx, const char *key, const int key_len) { unsigned char final_key[MAX_DIGEST_BLOCK_LEN] = {0}; unsigned char init_key[MAX_DIGEST_BLOCK_LEN] = {0}; + int final_len = key_len; memset(final_key, 0x00, MAX_DIGEST_BLOCK_LEN); - memcpy(init_key, key, key_len); + memset(init_key, 0x00, MAX_DIGEST_BLOCK_LEN); - if(SHA1_BLOCK_LEN < key_len) + if(key_len > MAX_DIGEST_BLOCK_LEN) + final_len = MAX_DIGEST_BLOCK_LEN; + + memcpy(init_key, key, final_len); + + if(SHA1_BLOCK_LEN < final_len) { /* Calculate the digest of the key */ - sha1(final_key, init_key, key_len); + sha1(final_key, init_key, final_len); } else { @@ -237,15 +249,21 @@ hmac_sha256_init(hmac_sha256_ctx *ctx, const char *key, const int key_len) { unsigned char final_key[MAX_DIGEST_BLOCK_LEN] = {0}; unsigned char init_key[MAX_DIGEST_BLOCK_LEN] = {0}; + int final_len = key_len; memset(final_key, 0x00, MAX_DIGEST_BLOCK_LEN); - memcpy(init_key, key, key_len); + memset(init_key, 0x00, MAX_DIGEST_BLOCK_LEN); - if(SHA256_BLOCK_LEN < key_len) + if(key_len > MAX_DIGEST_BLOCK_LEN) + final_len = MAX_DIGEST_BLOCK_LEN; + + memcpy(init_key, key, final_len); + + if(SHA256_BLOCK_LEN < final_len) { /* Calculate the digest of the key */ - sha256(final_key, init_key, key_len); + sha256(final_key, init_key, final_len); } else { @@ -305,15 +323,21 @@ hmac_sha384_init(hmac_sha384_ctx *ctx, const char *key, const int key_len) { unsigned char final_key[MAX_DIGEST_BLOCK_LEN] = {0}; unsigned char init_key[MAX_DIGEST_BLOCK_LEN] = {0}; + int final_len = key_len; memset(final_key, 0x00, MAX_DIGEST_BLOCK_LEN); - memcpy(init_key, key, key_len); + memset(init_key, 0x00, MAX_DIGEST_BLOCK_LEN); - if(SHA384_BLOCK_LEN < key_len) + if(key_len > MAX_DIGEST_BLOCK_LEN) + final_len = MAX_DIGEST_BLOCK_LEN; + + memcpy(init_key, key, final_len); + + if(SHA384_BLOCK_LEN < final_len) { /* Calculate the digest of the key */ - sha384(final_key, init_key, key_len); + sha384(final_key, init_key, final_len); } else { @@ -373,15 +397,21 @@ hmac_sha512_init(hmac_sha512_ctx *ctx, const char *key, const int key_len) { unsigned char final_key[MAX_DIGEST_BLOCK_LEN] = {0}; unsigned char init_key[MAX_DIGEST_BLOCK_LEN] = {0}; + int final_len = key_len; memset(final_key, 0x00, MAX_DIGEST_BLOCK_LEN); - memcpy(init_key, key, key_len); + memset(init_key, 0x00, MAX_DIGEST_BLOCK_LEN); - if(SHA512_BLOCK_LEN < key_len) + if(key_len > MAX_DIGEST_BLOCK_LEN) + final_len = MAX_DIGEST_BLOCK_LEN; + + memcpy(init_key, key, final_len); + + if(SHA512_BLOCK_LEN < final_len) { /* Calculate the digest of the key */ - sha512(final_key, init_key, key_len); + sha512(final_key, init_key, final_len); } else {