[gnutls-devel] GnuTLS | buffer size checks in accelerated cipher implementations (!1521)

[Read-only notification of GnuTLS library development activities]

Merge request https://gitlab.com/gnutls/gnutls/-/merge_requests/1521 was reviewed by Daiki Ueno

--
  
Daiki Ueno started a new discussion on lib/accelerated/x86/aes-gcm-aead.h: https://gitlab.com/gnutls/gnutls/-/merge_requests/1521#note_821771006

>  	/* proper AEAD cipher */
> -	if (encr_size < plain_size + tag_size)
> +	if (unlikely(encr_size < plain_size + tag_size))

Maybe good to use the same condition used elsewhere (`plain_size < encr_size - tag_size`)? That would avoid integer overflow as [suggested](https://www.enyo.de/fw/notes/style-guide-conditions.html).

--
  
Daiki Ueno commented on a discussion on lib/accelerated/afalg.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1521#note_821771019

>  	iov.iov_base = (void *)dst;
> -	iov.iov_len = (src_size > dst_size) ? dst_size : src_size;
> +	iov.iov_len = src_size;

There was a discussion on this in the original [MR](https://gitlab.com/gnutls/gnutls/-/merge_requests/1404), but I am not really sure. @FrantisekKrenzelok or @smuellerDD might remember the reason. If `gnutls-cli --benchmark-ciphers` works with AF_ALG with this change, I guess that's ok.


-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1521
You're receiving this email because of your account on gitlab.com.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20220126/20015a64/attachment.html>