From d3d7bdf8215275b3b20690dfde3f43dbe25b6f85 Mon Sep 17 00:00:00 2001 From: Peter Wu Date: Wed, 23 Mar 2016 03:45:20 +0100 Subject: Fix buffer overrun in gettag for GCM * cipher/cipher-gcm.c: copy a fixed length instead of the user-supplied number. -- The outbuflen is used to check the minimum size, the real tag is always of fixed length. Signed-off-by: Peter Wu Actually this is not a buffer overrun because we copy not more than has been allocated for OUTBUF. However a too long OUTBUFLEN accesses data outside of the source buffer. -wk --- cipher/cipher-gcm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cipher/cipher-gcm.c b/cipher/cipher-gcm.c index d390ef84..cb81ea93 100644 --- a/cipher/cipher-gcm.c +++ b/cipher/cipher-gcm.c @@ -803,12 +803,12 @@ _gcry_cipher_gcm_tag (gcry_cipher_hd_t c, if (!check) { - memcpy (outbuf, c->u_mode.gcm.u_tag.tag, outbuflen); + memcpy (outbuf, c->u_mode.gcm.u_tag.tag, GCRY_GCM_BLOCK_LEN); return GPG_ERR_NO_ERROR; } else { - return buf_eq_const(outbuf, c->u_mode.gcm.u_tag.tag, outbuflen) ? + return buf_eq_const(outbuf, c->u_mode.gcm.u_tag.tag, GCRY_GCM_BLOCK_LEN) ? GPG_ERR_NO_ERROR : GPG_ERR_CHECKSUM; } -- cgit v1.2.1