chacha20/poly1305: make sure to clear the buffer at correct position
authorRichard Levitte <levitte@openssl.org>
Fri, 4 Nov 2016 13:21:46 +0000 (14:21 +0100)
committerMatt Caswell <matt@openssl.org>
Thu, 10 Nov 2016 13:04:11 +0000 (13:04 +0000)
The offset to the memory to clear was incorrect, causing a heap buffer
overflow.

CVE-2016-7054

Thanks to Robert Święcki for reporting this

Reviewed-by: Rich Salz <rsalz@openssl.org>
crypto/evp/e_chacha20_poly1305.c

index cf4097ba5daf1e231b2e75d8d8c32aa0de9df4fe..952bd3fca781196a595e43d70fb9a76c3fd072a7 100644 (file)
@@ -299,7 +299,7 @@ static int chacha20_poly1305_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
                 memcpy(out, actx->tag, POLY1305_BLOCK_SIZE);
             } else {
                 if (CRYPTO_memcmp(temp, in, POLY1305_BLOCK_SIZE)) {
-                    memset(out, 0, plen);
+                    memset(out - plen, 0, plen);
                     return -1;
                 }
             }