From acbd84f5741451d67e0fbaa3b85fdafc85dab5f9 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Sun, 28 Jan 2018 10:25:49 +0100 Subject: Check for integer overflow in AesTask::DoCrypto() (DiD) After calling mResult.SetLength(mData.Length() + 16) we should check that the integer addition didn't overflow. It seems at the moment impossible to create ArrayBuffers of size >= 0x0xfffffff0, however adding a check here doesn't hurt. mResult.Length() is passed to the PK11 API functions as a maxOut parameter and should be checked by the softoken crypto algorithm implementations. AES-ECB and AES-GCM seem to do that correctly. --- dom/crypto/WebCryptoTask.cpp | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'dom/crypto/WebCryptoTask.cpp') diff --git a/dom/crypto/WebCryptoTask.cpp b/dom/crypto/WebCryptoTask.cpp index 57a7da186..f5fc7b5bc 100644 --- a/dom/crypto/WebCryptoTask.cpp +++ b/dom/crypto/WebCryptoTask.cpp @@ -716,6 +716,11 @@ private: return NS_ERROR_DOM_INVALID_ACCESS_ERR; } + // Check whether the integer addition would overflow. + if (std::numeric_limits::max() - 16 < mData.Length()) { + return NS_ERROR_DOM_DATA_ERR; + } + // Initialize the output buffer (enough space for padding / a full tag) uint32_t dataLen = mData.Length(); uint32_t maxLen = dataLen + 16; -- cgit v1.2.3