fix: resource exhaustion from an incomplete encrypted message (#348)

Decrypt needs to actively verify
that it has reached the end of the encrypted message.
This fix ensures an error on an incomplete encrypted message

Also, the signature_info parsing needed to be updated,
to handle an incomplete signature block.

Browsers were never impacted,
but the tests were included for completeness.

Author: seebees

modules/decrypt-browser/test/decrypt.test.ts

@@ -3,10 +3,13 @@
 
 /* eslint-env mocha */
 
-import { expect } from 'chai'
+import * as chai from 'chai'
+import chaiAsPromised from 'chai-as-promised'
 import { decrypt } from '../src/index'
 import { AlgorithmSuiteIdentifier } from '@aws-crypto/material-management-browser'
 import * as fixtures from './fixtures'
+chai.use(chaiAsPromised)
+const { expect } = chai
 
 describe('decrypt', () => {
   it('buffer', async () => {
@@ -52,4 +55,34 @@ describe('decrypt', () => {
       }
     )
   })
+
+  it('verify incomplete chipertext will fail for an un-signed algorithm suite', async () => {
+    const data = fixtures.base64CiphertextAlgAes256GcmIv12Tag16HkdfWith4Frames()
+    const keyring = fixtures.decryptKeyring()
+
+    // First we make sure that the test vector is well formed
+    await decrypt(keyring, data)
+
+    // This is the real test:
+    // trying to decrypt
+    // on EVERY boundary
+    for (let i = 0; data.byteLength > i; i++) {
+      await expect(decrypt(keyring, data.slice(0, i))).to.rejectedWith(Error)
+    }
+  })
+
+  it('verify incomplete chipertext will fail for a signed algorithm suite', async () => {
+    const data = fixtures.base64CiphertextAlgAes256GcmIv12Tag16HkdfSha384EcdsaP384With4Frames()
+    const keyring = fixtures.decryptKeyring()
+
+    // First we make sure that the test vector is well formed
+    await decrypt(keyring, data)
+
+    // This is the real test:
+    // trying to decrypt
+    // on EVERY boundary
+    for (let i = 0; data.byteLength > i; i++) {
+      await expect(decrypt(keyring, data.slice(0, i))).to.rejectedWith(Error)
+    }
+  })
 })