diff mbox series

[Openvpn-devel,v2] tls_crypt: append cipher final output at buffer end

Message ID 20261102171317.113895-1-frank@lichtenheld.com
State New
Headers
Series [Openvpn-devel,v2] tls_crypt: append cipher final output at buffer end |

Commit Message

Frank Lichtenheld Nov. 2, 2026, 5:13 p.m. UTC 
  From: Razvan Cojocaru <razvanc@mailbox.org>

tls_crypt_wrap() and tls_crypt_unwrap() passed BPTR(dst) to
cipher_ctx_final(), which would overwrite the start of dst if final
produced output. Use BEND(dst), as the tls-crypt-v2 code does.
No functional change with AES-256-CTR, whose final produces 0 bytes.

Change-Id: Ie0f902ae5aa8e549f76f2cf32facda43eac18915
Signed-off-by: Razvan Cojocaru <razvanc@mailbox.org>
Acked-by: Arne Schwabe <arne-openvpn@rfc2549.org>
Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2083
---

This change was reviewed on Gerrit and approved by at least one
developer. I request to merge it to master.

Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/2083
This mail reflects revision 2 of this Change.

Acked-by according to Gerrit (reflected above):
Arne Schwabe <arne-openvpn@rfc2549.org>
diff mbox series

Patch

diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c
index 23c7975..d015004 100644
--- a/src/openvpn/tls_crypt.c
+++ b/src/openvpn/tls_crypt.c
@@ -191,7 +191,7 @@ 
         int outlen = 0;
         ASSERT(cipher_ctx_update(ctx->cipher, BEND(dst), &outlen, CBPTR(src), BLEN(src)));
         ASSERT(buf_inc_len(dst, outlen));
-        ASSERT(cipher_ctx_final(ctx->cipher, BPTR(dst), &outlen));
+        ASSERT(cipher_ctx_final(ctx->cipher, BEND(dst), &outlen));
         ASSERT(buf_inc_len(dst, outlen));
     }
 
@@ -247,7 +247,7 @@ 
             CRYPT_ERROR("cipher update failed");
         }
         ASSERT(buf_inc_len(dst, outlen));
-        if (!cipher_ctx_final(ctx->cipher, BPTR(dst), &outlen))
+        if (!cipher_ctx_final(ctx->cipher, BEND(dst), &outlen))
         {
             CRYPT_ERROR("cipher final failed");
         }