624042 - Softoken cannot decrypt padded data into a buffer that does not reserve room for the padding

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

> /* this assumes that pLastPart is big enough to hold the *whole*
>  * buffer!!! */
> rv = (*context->update)(context->cipherInfo, pLastPart, &outlen,
>    maxout, context->padBuf, context->blockSize);

We should remove the assumption; decrypt the last block into a separate tem buffer, check the padding, copy the decrypted data into pLastPart, and then zeroize the temp buffer.

Comment 1

[Wan-Teh Chang]

bsmith: just to confirm my understanding: this bug will result in a
decryption failure but not a buffer overflow, right?  If pLastPart
does not reserve room for the padding, the (*context->update)() call
you showed should fail.

If so, this bug isn't serious because without knowing the length of
the plaintext in advance, the caller has to use an output buffer
large enough for a padding of only one byte.  I think most callers
will use an output buffer that's at least as long as the ciphertext.