diff options
| author | Shane Lontis <shane.lontis@oracle.com> | 2021-05-01 14:49:25 +1000 |
|---|---|---|
| committer | Shane Lontis <shane.lontis@oracle.com> | 2021-05-05 17:39:27 +1000 |
| commit | 2b05439f8441a5483da65fd4208d82d9e007f448 (patch) | |
| tree | 82dee791ba1aa5f7e8cb99fdef48c46437100fd9 /providers/fips.checksum | |
| parent | 029875dc5ba28f18e3067c883fb53c9ae91d6954 (diff) | |
Fix KMAC bounds checks.
Setting an output length higher than 8191 was causing a buffer overflow.
This was reported by Acumen (FIPS lab).
The max output size has increased to ~2M and it now checks this during set_parameters.
The encoder related functions now pass in the maximum size of the output buffer so they
can correctly check their size. kmac_bytepad_encode_key() calls bytepad twice in
order to calculate and check the length before encoding.
Note that right_encode() is currently only used in one place but this
may change if other algorithms are supported (such as TupleHash).
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15106)
Diffstat (limited to 'providers/fips.checksum')
| -rw-r--r-- | providers/fips.checksum | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/providers/fips.checksum b/providers/fips.checksum index 468c3c986e..ff7a1c2c78 100644 --- a/providers/fips.checksum +++ b/providers/fips.checksum @@ -1 +1 @@ -16e17331a77aed06b6537cafdacd35df08fbc888c04eb7cca928a4a39d858642 providers/fips-sources.checksums +b998b19b940b606688e4711014407c48c3fca4c58b2fdc60ac64c1cef94861c1 providers/fips-sources.checksums |