Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Check for overflow on input lengths #195

Merged
merged 1 commit into from Feb 26, 2017
Merged

Check for overflow on input lengths #195

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
14 changes: 13 additions & 1 deletion src/argon2.c
View file
Open in desktop
Expand Up @@ -104,6 +104,14 @@ int argon2_hash(const uint32_t t_cost, const uint32_t m_cost,
int result;
uint8_t *out;

if (pwdlen > ARGON2_MAX_PWD_LENGTH) {
return ARGON2_PWD_TOO_LONG;
}

if (saltlen > ARGON2_MAX_SALT_LENGTH) {
return ARGON2_SALT_TOO_LONG;
}

if (hashlen > ARGON2_MAX_OUTLEN) {
return ARGON2_OUTPUT_TOO_LONG;
}
Expand Down Expand Up @@ -245,6 +253,10 @@ int argon2_verify(const char *encoded, const void *pwd, const size_t pwdlen,
size_t encoded_len;
uint32_t max_field_len;

if (pwdlen > ARGON2_MAX_PWD_LENGTH) {
return ARGON2_PWD_TOO_LONG;
}

if (encoded == NULL) {
return ARGON2_DECODING_FAIL;
}
Expand All @@ -268,7 +280,7 @@ int argon2_verify(const char *encoded, const void *pwd, const size_t pwdlen,
}

ctx.pwd = (uint8_t *)pwd;
ctx.pwdlen = pwdlen;
ctx.pwdlen = (uint32_t)pwdlen;

ret = decode_string(&ctx, encoded, type);
if (ret != ARGON2_OK) {
Expand Down