diff options
| author | Mårten Nordheim <marten.nordheim@qt.io> | 2023-03-08 11:10:49 +0100 |
|---|---|---|
| committer | Marc Mutz <marc.mutz@qt.io> | 2023-03-10 14:39:37 +0000 |
| commit | fa4b7495b741c3e7943860c5ff15212afceda710 (patch) | |
| tree | 0ccf1097ab03488c29e80e0563cb259a9dafa948 /src/3rdparty | |
| parent | 4f02973e2f447dfc92234ec247d7157ea0e1e807 (diff) | |
Fix overflow in SHA-3/Keccak
state->rate is always larger than or equal to state->bitsInQueue;
when bitsInQueue == rate the queue is consumed and bitsInQueue is set to
0 again.
Done-with: Marc Mutz <marc.mutz@qt.io>
Pick-to: 6.5.0 6.5 6.4.3 6.4 6.2 5.15
Change-Id: I56d268a19fb3cd542cc027edc962253f09d97a14
Reviewed-by: Marc Mutz <marc.mutz@qt.io>
Reviewed-by: Volker Hilsheimer <volker.hilsheimer@qt.io>
Diffstat (limited to 'src/3rdparty')
| -rw-r--r-- | src/3rdparty/sha3/KeccakSponge.c | 5 | ||||
| -rw-r--r-- | src/3rdparty/sha3/overflow.patch | 31 | ||||
| -rw-r--r-- | src/3rdparty/sha3/qt_attribution.json | 1 |
3 files changed, 35 insertions, 2 deletions
diff --git a/src/3rdparty/sha3/KeccakSponge.c b/src/3rdparty/sha3/KeccakSponge.c index 6f3da95dbb..337c10ccaf 100644 --- a/src/3rdparty/sha3/KeccakSponge.c +++ b/src/3rdparty/sha3/KeccakSponge.c @@ -170,9 +170,10 @@ static int Absorb(spongeState *state, const unsigned char *data, unsigned long l i += wholeBlocks*state->rate; } else { - partialBlock = (unsigned int)(databitlen - i); - if (partialBlock+state->bitsInQueue > state->rate) + if (databitlen-i > state->rate - state->bitsInQueue) partialBlock = state->rate-state->bitsInQueue; + else + partialBlock = (unsigned int)(databitlen - i); partialByte = partialBlock % 8; partialBlock -= partialByte; memcpy(state->dataQueue+state->bitsInQueue/8, data+i/8, partialBlock/8); diff --git a/src/3rdparty/sha3/overflow.patch b/src/3rdparty/sha3/overflow.patch new file mode 100644 index 0000000000..f62a932ac8 --- /dev/null +++ b/src/3rdparty/sha3/overflow.patch @@ -0,0 +1,31 @@ +From a60180d3f8ffac268f02d2d4b0b4fbf1bff50f11 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?M=C3=A5rten=20Nordheim?= <marten.nordheim@qt.io> +Date: Wed, 8 Mar 2023 11:10:49 +0100 +Subject: [PATCH] Fix overflow in SHA-3/Keccak + +Pick-to: 6.5.0 6.5 6.4.3 6.4 6.2 5.15 +Change-Id: I56d268a19fb3cd542cc027edc962253f09d97a14 +--- + src/3rdparty/sha3/KeccakSponge.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/3rdparty/sha3/KeccakSponge.c b/src/3rdparty/sha3/KeccakSponge.c +index 6f3da95dbb..337c10ccaf 100644 +--- a/src/3rdparty/sha3/KeccakSponge.c ++++ b/src/3rdparty/sha3/KeccakSponge.c +@@ -170,9 +170,10 @@ static int Absorb(spongeState *state, const unsigned char *data, unsigned long l + i += wholeBlocks*state->rate; + } + else { +- partialBlock = (unsigned int)(databitlen - i); +- if (partialBlock+state->bitsInQueue > state->rate) ++ if (databitlen-i > state->rate - state->bitsInQueue) + partialBlock = state->rate-state->bitsInQueue; ++ else ++ partialBlock = (unsigned int)(databitlen - i); + partialByte = partialBlock % 8; + partialBlock -= partialByte; + memcpy(state->dataQueue+state->bitsInQueue/8, data+i/8, partialBlock/8); +-- +2.39.2.vfs.0.0 + diff --git a/src/3rdparty/sha3/qt_attribution.json b/src/3rdparty/sha3/qt_attribution.json index 4e53cfae0f..53e9791523 100644 --- a/src/3rdparty/sha3/qt_attribution.json +++ b/src/3rdparty/sha3/qt_attribution.json @@ -21,6 +21,7 @@ "QtUsage": "Used in Qt Core (QCryptographicHash).", "Files": "https://keccak.team/obsolete/KeccakReferenceAndOptimized-3.2.zip - but it's obsolete", "Files": "KeccakF-1600-32-rvk.macros KeccakF-1600-32.macros KeccakF-1600-64.macros KeccakF-1600-interface.h KeccakF-1600-opt32.c KeccakF-1600-opt64.c KeccakF-1600-unrolling.macros KeccakNISTInterface.c KeccakNISTInterface.h KeccakSponge.c KeccakSponge.h", + "Files": "With overflow.patch applied", "Description": "SHA-3, originally known as Keccak, is a cryptographic hash function.", "Version": "3.2", |