Commit 153ba46a5b20f178d48ef2f09e0e638a3749af0e | zig

author	Frank Denis <124872+jedisct1@users.noreply.github.com> 2024-03-12 23:56:28+01:00
committer	GitHub <noreply@github.com> 2024-03-12 22:56:28+00:00
log	153ba46a5b20f178d48ef2f09e0e638a3749af0e
tree	e22ac3519e43eeb4e82511f572a1bcdb5a454576
parent	b8920bceb79756aead8635d156a6e8bffcc1ccea
signature	Signed by PGP key B5690EEEBB952194

{aegis,aes_gcm}: fix overflow with large inputs on 32-bit systems (#19270)

These systems write the number of *bits* of their inputs as a u64.

However if `@sizeOf(usize) == 4`, an input message or associated data
whose size is > 512 MiB could overflow.

On 64-bit systems, it is safe to assume that no machine has more than
2 EiB of memory.

2 files changed, 8 insertions(+), 8 deletions(-)

lib
- std
  - crypto
    aegis.zig
    aes_gcm.zig

lib/std/crypto/aegis.zig+4-4

...	...	@@ -106,8 +106,8 @@ const State128L = struct {
106	106	fn mac(state: *State128L, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
107	107	const blocks = &state.blocks;
108	108	var sizes: [16]u8 = undefined;
109		mem.writeInt(u64, sizes[0..8], adlen * 8, .little);
110		mem.writeInt(u64, sizes[8..16], mlen * 8, .little);
	109	mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
	110	mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
111	111	const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[2]);
112	112	var i: usize = 0;
113	113	while (i < 7) : (i += 1) {
...	...	@@ -284,8 +284,8 @@ const State256 = struct {
284	284	fn mac(state: *State256, comptime tag_bits: u9, adlen: usize, mlen: usize) [tag_bits / 8]u8 {
285	285	const blocks = &state.blocks;
286	286	var sizes: [16]u8 = undefined;
287		mem.writeInt(u64, sizes[0..8], adlen * 8, .little);
288		mem.writeInt(u64, sizes[8..16], mlen * 8, .little);
	287	mem.writeInt(u64, sizes[0..8], @as(u64, adlen) * 8, .little);
	288	mem.writeInt(u64, sizes[8..16], @as(u64, mlen) * 8, .little);
289	289	const tmp = AesBlock.fromBytes(&sizes).xorBlocks(blocks[3]);
290	290	var i: usize = 0;
291	291	while (i < 7) : (i += 1) {

lib/std/crypto/aes_gcm.zig+4-4

...	...	@@ -46,8 +46,8 @@ fn AesGcm(comptime Aes: anytype) type {
46	46	mac.pad();
47	47
48	48	var final_block = h;
49		mem.writeInt(u64, final_block[0..8], ad.len * 8, .big);
50		mem.writeInt(u64, final_block[8..16], m.len * 8, .big);
	49	mem.writeInt(u64, final_block[0..8], @as(u64, ad.len) * 8, .big);
	50	mem.writeInt(u64, final_block[8..16], @as(u64, m.len) * 8, .big);
51	51	mac.update(&final_block);
52	52	mac.final(tag);
53	53	for (t, 0..) \|x, i\| {
...	...	@@ -86,8 +86,8 @@ fn AesGcm(comptime Aes: anytype) type {
86	86	mac.pad();
87	87
88	88	var final_block = h;
89		mem.writeInt(u64, final_block[0..8], ad.len * 8, .big);
90		mem.writeInt(u64, final_block[8..16], m.len * 8, .big);
	89	mem.writeInt(u64, final_block[0..8], @as(u64, ad.len) * 8, .big);
	90	mem.writeInt(u64, final_block[8..16], @as(u64, m.len) * 8, .big);
91	91	mac.update(&final_block);
92	92	var computed_tag: [Ghash.mac_length]u8 = undefined;
93	93	mac.final(&computed_tag);