From 5b49878cdbefb58b42302d64a71bca9a1868c4ad Mon Sep 17 00:00:00 2001 From: Andrew Kozlik Date: Wed, 20 Feb 2019 18:27:19 +0100 Subject: [PATCH] Check that the input to storage_set_encrypted() doesn't exceed the maximum length of 65507. --- storage.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/storage.c b/storage.c index 40a506e20b..5d17ef24c5 100644 --- a/storage.c +++ b/storage.c @@ -906,8 +906,11 @@ secbool storage_get(const uint16_t key, void *val_dest, const uint16_t max_len, */ static secbool storage_set_encrypted(const uint16_t key, const void *val, const uint16_t len) { + if (len > UINT16_MAX - CHACHA20_IV_SIZE - POLY1305_TAG_SIZE) { + return secfalse; + } + // Preallocate space on the flash storage. - uint16_t offset = 0; if (sectrue != auth_set(key, NULL, CHACHA20_IV_SIZE + len + POLY1305_TAG_SIZE)) { return secfalse; } @@ -915,6 +918,7 @@ static secbool storage_set_encrypted(const uint16_t key, const void *val, const // Write the IV to the flash. uint8_t buffer[CHACHA20_BLOCK_SIZE + POLY1305_TAG_SIZE]; random_buffer(buffer, CHACHA20_IV_SIZE); + uint16_t offset = 0; if (sectrue != norcow_update_bytes(key, offset, buffer, CHACHA20_IV_SIZE)) { return secfalse; }