From 04962f0637dddc949d9e346c47fed4bd42f8ea6f Mon Sep 17 00:00:00 2001 From: Giacomo Tesio Date: Tue, 17 Jan 2017 21:05:59 +0100 Subject: [PATCH] libsec: fix #3: out-of-bound access in aesXCBCmac (CID 155914) --- sys/src/lib/sec/port/aes.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sys/src/lib/sec/port/aes.c b/sys/src/lib/sec/port/aes.c index b6cd6d3..68b4bdb 100644 --- a/sys/src/lib/sec/port/aes.c +++ b/sys/src/lib/sec/port/aes.c @@ -128,6 +128,7 @@ aesXCBCmac(uint8_t *p, int len, AESstate *s) uint8_t q[AESbsize]; assert(s->keybytes == 16); /* more complicated for bigger */ + assert(s->rounds <= sizeof(s->mackey)/sizeof(uint32_t)); memset(s->ivec, 0, AESbsize); /* E[0] is 0+ */ for(; len > AESbsize; len -= AESbsize){