Skip to content

Commit 7ffff31

Browse files
committed
Fix sz==0 buffer underflow in devcrypto AES-CBC
1 parent 8169780 commit 7ffff31

File tree

1 file changed

+9
-2
lines changed

1 file changed

+9
-2
lines changed

wolfcrypt/src/port/devcrypto/devcrypto_aes.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,11 @@ int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
4444
return BAD_FUNC_ARG;
4545
}
4646

47-
/* encrypt only up to AES block size of date */
47+
/* encrypt only up to AES block size of data */
4848
sz = sz - (sz % WC_AES_BLOCK_SIZE);
49+
if (sz == 0) {
50+
return 0;
51+
}
4952
if (aes->ctx.cfd == -1) {
5053
ret = wc_DevCryptoCreate(&aes->ctx, CRYPTO_AES_CBC,
5154
(byte*)aes->devKey, aes->keylen);
@@ -71,9 +74,13 @@ int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
7174
struct crypt_op crt;
7275
int ret;
7376

74-
if (aes == NULL || out == NULL || in == NULL || sz % WC_AES_BLOCK_SIZE != 0) {
77+
if (aes == NULL || out == NULL || in == NULL
78+
|| sz % WC_AES_BLOCK_SIZE != 0) {
7579
return BAD_FUNC_ARG;
7680
}
81+
if (sz == 0) {
82+
return 0;
83+
}
7784

7885
XMEMCPY(aes->tmp, in + sz - WC_AES_BLOCK_SIZE, WC_AES_BLOCK_SIZE);
7986
if (aes->ctx.cfd == -1) {

0 commit comments

Comments
 (0)