Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(hal): clamp tag_len in aes_hal_gcm_read_tag to prevent OOB

Browse Source
This commit is contained in:
Ashish Sharma
2026-08-25 12:02:05 +08:00
parent 899aeadd7c
commit 1fc6094b14
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/hal/aes_hal.c
+6 -1
View File
@@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2020-2024 Espressif Systems (Shanghai) CO LTD * SPDX-FileCopyrightText: 2020-2026 Espressif Systems (Shanghai) CO LTD
* *
* SPDX-License-Identifier: Apache-2.0 * SPDX-License-Identifier: Apache-2.0
*/ */
@@ -126,6 +126,11 @@ void aes_hal_gcm_read_tag(uint8_t *tag, size_t tag_len)
{ {
uint8_t tag_res[TAG_BYTES]; uint8_t tag_res[TAG_BYTES];
aes_ll_gcm_read_tag(tag_res); aes_ll_gcm_read_tag(tag_res);
/* The GCM tag is at most TAG_BYTES (16). Clamp the caller-supplied length so an oversized
* tag_len cannot over-read tag_res or over-write the caller's tag buffer (CWE-125). */
if (tag_len > TAG_BYTES) {
tag_len = TAG_BYTES;
}
memcpy(tag, tag_res, tag_len); memcpy(tag, tag_res, tag_len);
} }