From 8c9c36ee2a315580d0fe30e266edf52a1de5e67b Mon Sep 17 00:00:00 2001 From: jsteube Date: Fri, 25 Aug 2017 11:52:07 +0200 Subject: [PATCH] Fix out-of-bound access in aesXXX_InvertKey() --- OpenCL/inc_cipher_aes.cl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/OpenCL/inc_cipher_aes.cl b/OpenCL/inc_cipher_aes.cl index 732cae2a6..0b4014d98 100644 --- a/OpenCL/inc_cipher_aes.cl +++ b/OpenCL/inc_cipher_aes.cl @@ -726,7 +726,7 @@ static void aes128_ExpandKey (u32 *ks, const u32 *ukey, SHM_TYPE u32 *s_te0, SHM static void aes128_InvertKey (u32 *ks, SHM_TYPE u32 *s_te0, SHM_TYPE u32 *s_te1, SHM_TYPE u32 *s_te2, SHM_TYPE u32 *s_te3, SHM_TYPE u32 *s_te4, SHM_TYPE u32 *s_td0, SHM_TYPE u32 *s_td1, SHM_TYPE u32 *s_td2, SHM_TYPE u32 *s_td3, SHM_TYPE u32 *s_td4) { - for (u32 i = 0, j = 40; i < 20; i += 4, j -= 4) + for (u32 i = 0, j = 40; i < j; i += 4, j -= 4) { u32 temp; @@ -965,7 +965,7 @@ static void aes256_ExpandKey (u32 *ks, const u32 *ukey, SHM_TYPE u32 *s_te0, SHM static void aes256_InvertKey (u32 *ks, SHM_TYPE u32 *s_te0, SHM_TYPE u32 *s_te1, SHM_TYPE u32 *s_te2, SHM_TYPE u32 *s_te3, SHM_TYPE u32 *s_te4, SHM_TYPE u32 *s_td0, SHM_TYPE u32 *s_td1, SHM_TYPE u32 *s_td2, SHM_TYPE u32 *s_td3, SHM_TYPE u32 *s_td4) { - for (u32 i = 0, j = 56; i < 28; i += 4, j -= 4) + for (u32 i = 0, j = 56; i < j; i += 4, j -= 4) { u32 temp;