From 1e07562da40d9bdb20ba9b14f9138bba96d1220b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Thu, 10 Dec 2015 14:46:25 +0100 Subject: [PATCH] Fix wrong length limit in GCM See for example page 8 of http://csrc.nist.gov/publications/nistpubs/800-38D/SP-800-38D.pdf The previous constant probably came from a typo as it was 2^26 - 2^5 instead of 2^36 - 2^5. Clearly the intention was to allow for a constant bigger than 2^32 as the ull suffix and cast to uint64_t show. fixes #362 --- ChangeLog | 5 +++++ library/gcm.c | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 8a736f971..4526254da 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,10 @@ mbed TLS ChangeLog (Sorted per branch, date) += mbed TLS 2.2.1 released 2015-12-xx + +Bugfix + * Fix over-restricive length limit in GCM. Found by Andreas-N. #362 + = mbed TLS 2.2.0 released 2015-11-04 Security diff --git a/library/gcm.c b/library/gcm.c index 4298254d2..aaacf97d6 100644 --- a/library/gcm.c +++ b/library/gcm.c @@ -362,7 +362,7 @@ int mbedtls_gcm_update( mbedtls_gcm_context *ctx, /* Total length is restricted to 2^39 - 256 bits, ie 2^36 - 2^5 bytes * Also check for possible overflow */ if( ctx->len + length < ctx->len || - (uint64_t) ctx->len + length > 0x03FFFFE0ull ) + (uint64_t) ctx->len + length > 0xFFFFFFFE0ull ) { return( MBEDTLS_ERR_GCM_BAD_INPUT ); }