[gnutls-devel] GnuTLS | Allow registering ciphers with higher priority (!1404)

[Read-only notification of GnuTLS library development activities]

Stephan Mueller commented on a discussion on lib/accelerated/afalg.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404#note_531113363

> +	 * read-only
> +	 */
> +	iov[1].iov_base = (void *)encr;
> +	iov[1].iov_len = encr_size;
> +
> +	if (kcapi_aead_stream_update_last(ctx->handle, iov, 2) < 0) {
> +		gnutls_assert();
> +		return GNUTLS_E_ENCRYPTION_FAILED;
> +	}
> +
> +	/* The kernel may set the AAD, avoid modification of auth */
> +	iov[0].iov_base = authtmp;
> +
> +	/* Set PT buffer to be filled by kernel */
> +	iov[1].iov_base = plain;
> +	iov[1].iov_len = plain_size;

May I ask for the motivation to use `kcapi_aead_outbuflen_dec`? I fear that you can easily introduce a buffer overflow this way as `kcapi_aead_outbuflen_dec` returns the size needed in user space to fulfill the request. Are you sure that plain is of sufficient size?

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1404#note_531113363
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20210317/55946adf/attachment-0001.html>