authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2024-03-12 23:56:28+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2024-03-12 22:56:28+00:00
log153ba46a5b20f178d48ef2f09e0e638a3749af0e
treee22ac3519e43eeb4e82511f572a1bcdb5a454576
parentb8920bceb79756aead8635d156a6e8bffcc1ccea
signaturebadge-check Signed by PGP key B5690EEEBB952194

{aegis,aes_gcm}: fix overflow with large inputs on 32-bit systems (#19270)

These systems write the number of *bits* of their inputs as a u64. However if `@sizeOf(usize) == 4`, an input message or associated data whose size is > 512 MiB could overflow. On 64-bit systems, it is safe to assume that no machine has more than 2 EiB of memory.

2 files changed, 8 insertions(+), 8 deletions(-)

lib/std/crypto/aegis.zig+4-4
...@@ -106,8 +106,8 @@ const State128L = struct {...@@ -106,8 +106,8 @@ const State128L = struct {
106 fn mac(state: *State128L, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {106 fn mac(state: *State128L, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
107 const blocks = &state.blocks;107 const blocks = &state.blocks;
108 var sizes: [16]u8 = undefined;108 var sizes: [16]u8 = undefined;
109 mem.writeInt(u64, sizes[0..8], adlen * 8, .little);109 mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
110 mem.writeInt(u64, sizes[8..16], mlen * 8, .little);110 mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
111 const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[2]);111 const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[2]);
112 var i: usize = 0;112 var i: usize = 0;
113 while (i < 7) : (i += 1) {113 while (i < 7) : (i += 1) {
...@@ -284,8 +284,8 @@ const State256 = struct {...@@ -284,8 +284,8 @@ const State256 = struct {
284 fn mac(state: *State256, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {284 fn mac(state: *State256, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
285 const blocks = &state.blocks;285 const blocks = &state.blocks;
286 var sizes: [16]u8 = undefined;286 var sizes: [16]u8 = undefined;
287 mem.writeInt(u64, sizes[0..8], adlen * 8, .little);287 mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
288 mem.writeInt(u64, sizes[8..16], mlen * 8, .little);288 mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
289 const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[3]);289 const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[3]);
290 var i: usize = 0;290 var i: usize = 0;
291 while (i < 7) : (i += 1) {291 while (i < 7) : (i += 1) {
lib/std/crypto/aes_gcm.zig+4-4
...@@ -46,8 +46,8 @@ fn AesGcm(comptime Aes: anytype) type {...@@ -46,8 +46,8 @@ fn AesGcm(comptime Aes: anytype) type {
46 mac.pad();46 mac.pad();
4747
48 var final_block = h;48 var final_block = h;
49 mem.writeInt(u64, final_block[0..8], ad.len * 8, .big);49 mem.writeInt(u64, final_block[0..8], @as(u64, ad.len) * 8, .big);
50 mem.writeInt(u64, final_block[8..16], m.len * 8, .big);50 mem.writeInt(u64, final_block[8..16], @as(u64, m.len) * 8, .big);
51 mac.update(&final_block);51 mac.update(&final_block);
52 mac.final(tag);52 mac.final(tag);
53 for (t, 0..) |x, i| {53 for (t, 0..) |x, i| {
...@@ -86,8 +86,8 @@ fn AesGcm(comptime Aes: anytype) type {...@@ -86,8 +86,8 @@ fn AesGcm(comptime Aes: anytype) type {
86 mac.pad();86 mac.pad();
8787
88 var final_block = h;88 var final_block = h;
89 mem.writeInt(u64, final_block[0..8], ad.len * 8, .big);89 mem.writeInt(u64, final_block[0..8], @as(u64, ad.len) * 8, .big);
90 mem.writeInt(u64, final_block[8..16], m.len * 8, .big);90 mem.writeInt(u64, final_block[8..16], @as(u64, m.len) * 8, .big);
91 mac.update(&final_block);91 mac.update(&final_block);
92 var computed_tag: [Ghash.mac_length]u8 = undefined;92 var computed_tag: [Ghash.mac_length]u8 = undefined;
93 mac.final(&computed_tag);93 mac.final(&computed_tag);