Skip to content

Commit b9e0a91

Browse files
cconloncconlon
committed
JNI: cast offset/length to jlong before addition in bounds checks (F-1521 / F-1523)
1 parent 3a9d4ac commit b9e0a91

8 files changed

Lines changed: 27 additions & 27 deletions

File tree

‎jni/jni_aes.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -128,11 +128,11 @@ Java_com_wolfssl_wolfcrypt_Aes_native_1update_1internal__I_3BII_3BI(
128128
}
129129
else if (length == 0) {
130130
ret = 0;
131-
} else if ((word32)(offset + length) >
131+
} else if (((jlong)offset + (jlong)length) >
132132
getByteArrayLength(env, input_object)) {
133133
ret = BUFFER_E; /* buffer overflow check */
134134
}
135-
else if ((word32)(outputOffset + length) >
135+
else if (((jlong)outputOffset + (jlong)length) >
136136
getByteArrayLength(env, output_object)) {
137137
ret = BUFFER_E; /* buffer overflow check */
138138
}
@@ -196,11 +196,11 @@ Java_com_wolfssl_wolfcrypt_Aes_native_1update_1internal__ILjava_nio_ByteBuffer_2
196196
else if (offset < 0 || length < 0) {
197197
ret = BAD_FUNC_ARG; /* signed sanizizers */
198198
}
199-
else if ((word32)(offset + length) >
199+
else if (((jlong)offset + (jlong)length) >
200200
getDirectBufferLimit(env, input_object)) {
201201
ret = BUFFER_E; /* buffer overflow check */
202202
}
203-
else if ((word32)(outputOffset + length) >
203+
else if (((jlong)outputOffset + (jlong)length) >
204204
getDirectBufferLimit(env, output_object)) {
205205
ret = BUFFER_E; /* buffer overflow check */
206206
}

‎jni/jni_aescmac.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_AesCmac_wc_1CmacUpdate___3BII(
183183

184184
/* Validate bounds to prevent buffer overflow */
185185
if (!cmac || !data || offset < 0 || length < 0 ||
186-
(word32)(offset + length) > dataSz) {
186+
((jlong)offset + (jlong)length) > dataSz) {
187187
ret = BAD_FUNC_ARG;
188188
} else {
189189
ret = wc_CmacUpdate(cmac, data + offset, length);
@@ -222,7 +222,7 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_AesCmac_wc_1CmacUpdate__Ljava_
222222

223223
/* Validate bounds to prevent buffer overflow */
224224
if (!cmac || !data || offset < 0 || length < 0 ||
225-
(word32)(offset + length) > bufferLimit) {
225+
((jlong)offset + (jlong)length) > bufferLimit) {
226226
ret = BAD_FUNC_ARG;
227227
} else {
228228
ret = wc_CmacUpdate(cmac, data + offset, length);

‎jni/jni_aesctr.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -133,11 +133,11 @@ Java_com_wolfssl_wolfcrypt_AesCtr_native_1update_1internal___3BII_3BI(
133133
else if (length == 0) {
134134
ret = 0;
135135
}
136-
else if ((word32)(offset + length) >
136+
else if (((jlong)offset + (jlong)length) >
137137
getByteArrayLength(env, input_object)) {
138138
ret = BUFFER_E; /* buffer overflow check */
139139
}
140-
else if ((word32)(outputOffset + length) >
140+
else if (((jlong)outputOffset + (jlong)length) >
141141
getByteArrayLength(env, output_object)) {
142142
ret = BUFFER_E; /* buffer overflow check */
143143
}
@@ -196,11 +196,11 @@ Java_com_wolfssl_wolfcrypt_AesCtr_native_1update_1internal__Ljava_nio_ByteBuffer
196196
else if (offset < 0 || length < 0) {
197197
ret = BAD_FUNC_ARG;
198198
}
199-
else if ((word32)(offset + length) >
199+
else if (((jlong)offset + (jlong)length) >
200200
getDirectBufferLimit(env, input_object)) {
201201
ret = BUFFER_E; /* buffer overflow check */
202202
}
203-
else if ((word32)(outputOffset + length) >
203+
else if (((jlong)outputOffset + (jlong)length) >
204204
getDirectBufferLimit(env, output_object)) {
205205
ret = BUFFER_E; /* buffer overflow check */
206206
}

‎jni/jni_aescts.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -161,11 +161,11 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesCts_native_1update_1interna
161161
/* CTS requires at least one block of input */
162162
ret = BUFFER_E;
163163
}
164-
else if ((word32)(offset + length) >
164+
else if (((jlong)offset + (jlong)length) >
165165
getByteArrayLength(env, input_object)) {
166166
ret = BUFFER_E; /* buffer overflow check */
167167
}
168-
else if ((word32)(outputOffset + length) >
168+
else if (((jlong)outputOffset + (jlong)length) >
169169
getByteArrayLength(env, output_object)) {
170170
ret = BUFFER_E; /* buffer overflow check */
171171
}
@@ -273,11 +273,11 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_wolfcrypt_AesCts_native_1update_1interna
273273
/* CTS requires at least one block of input */
274274
ret = BUFFER_E;
275275
}
276-
else if ((word32)(offset + length) >
276+
else if (((jlong)offset + (jlong)length) >
277277
getDirectBufferLimit(env, input_object)) {
278278
ret = BUFFER_E;
279279
}
280-
else if ((word32)(outputOffset + length) >
280+
else if (((jlong)outputOffset + (jlong)length) >
281281
getDirectBufferLimit(env, output_object)) {
282282
ret = BUFFER_E;
283283
}

‎jni/jni_aesecb.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -134,11 +134,11 @@ Java_com_wolfssl_wolfcrypt_AesEcb_native_1update_1internal__I_3BII_3BI(
134134
else if ((length % AES_BLOCK_SIZE) != 0) {
135135
ret = BAD_FUNC_ARG; /* ECB requires block-aligned data */
136136
}
137-
else if ((word32)(offset + length) >
137+
else if (((jlong)offset + (jlong)length) >
138138
getByteArrayLength(env, input_object)) {
139139
ret = BUFFER_E; /* buffer overflow check */
140140
}
141-
else if ((word32)(outputOffset + length) >
141+
else if (((jlong)outputOffset + (jlong)length) >
142142
getByteArrayLength(env, output_object)) {
143143
ret = BUFFER_E; /* buffer overflow check */
144144
}
@@ -205,11 +205,11 @@ Java_com_wolfssl_wolfcrypt_AesEcb_native_1update_1internal__ILjava_nio_ByteBuffe
205205
else if ((length % AES_BLOCK_SIZE) != 0) {
206206
ret = BAD_FUNC_ARG; /* ECB requires block-aligned data */
207207
}
208-
else if ((word32)(offset + length) >
208+
else if (((jlong)offset + (jlong)length) >
209209
getDirectBufferLimit(env, input_object)) {
210210
ret = BUFFER_E; /* buffer overflow check */
211211
}
212-
else if ((word32)(outputOffset + length) >
212+
else if (((jlong)outputOffset + (jlong)length) >
213213
getDirectBufferLimit(env, output_object)) {
214214
ret = BUFFER_E; /* buffer overflow check */
215215
}

‎jni/jni_aesofb.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -134,11 +134,11 @@ Java_com_wolfssl_wolfcrypt_AesOfb_native_1update_1internal__I_3BII_3BI(
134134
else if (length == 0) {
135135
ret = 0;
136136
}
137-
else if ((word32)(offset + length) >
137+
else if (((jlong)offset + (jlong)length) >
138138
getByteArrayLength(env, input_object)) {
139139
ret = BUFFER_E; /* buffer overflow check */
140140
}
141-
else if ((word32)(outputOffset + length) >
141+
else if (((jlong)outputOffset + (jlong)length) >
142142
getByteArrayLength(env, output_object)) {
143143
ret = BUFFER_E; /* buffer overflow check */
144144
}
@@ -210,11 +210,11 @@ Java_com_wolfssl_wolfcrypt_AesOfb_native_1update_1internal__ILjava_nio_ByteBuffe
210210
else if (offset < 0 || length < 0) {
211211
ret = BAD_FUNC_ARG;
212212
}
213-
else if ((word32)(offset + length) >
213+
else if (((jlong)offset + (jlong)length) >
214214
getDirectBufferLimit(env, input_object)) {
215215
ret = BUFFER_E; /* buffer overflow check */
216216
}
217-
else if ((word32)(outputOffset + length) >
217+
else if (((jlong)outputOffset + (jlong)length) >
218218
getDirectBufferLimit(env, output_object)) {
219219
ret = BUFFER_E; /* buffer overflow check */
220220
}

‎jni/jni_des3.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -123,11 +123,11 @@ Java_com_wolfssl_wolfcrypt_Des3_native_1update_1internal__I_3BII_3BI(
123123
else if (offset < 0 || length < 0 || outputOffset < 0) {
124124
ret = BAD_FUNC_ARG; /* signed sanizizers */
125125
}
126-
else if ((word32)(offset + length) >
126+
else if (((jlong)offset + (jlong)length) >
127127
getByteArrayLength(env, input_object)) {
128128
ret = BUFFER_E; /* buffer overflow check */
129129
}
130-
else if ((word32)(outputOffset + length) >
130+
else if (((jlong)outputOffset + (jlong)length) >
131131
getByteArrayLength(env, output_object)) {
132132
ret = BUFFER_E; /* buffer overflow check */
133133
}
@@ -190,11 +190,11 @@ Java_com_wolfssl_wolfcrypt_Des3_native_1update_1internal__ILjava_nio_ByteBuffer_
190190
else if (offset < 0 || length < 0) {
191191
ret = BAD_FUNC_ARG; /* signed sanizizers */
192192
}
193-
else if ((word32)(offset + length) >
193+
else if (((jlong)offset + (jlong)length) >
194194
getDirectBufferLimit(env, input_object)) {
195195
ret = BUFFER_E; /* buffer overflow check */
196196
}
197-
else if ((word32)(outputOffset + length) >
197+
else if (((jlong)outputOffset + (jlong)length) >
198198
getDirectBufferLimit(env, output_object)) {
199199
ret = BUFFER_E; /* buffer overflow check */
200200
}

‎jni/jni_rng.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ JNIEXPORT void JNICALL Java_com_wolfssl_wolfcrypt_Rng_rngGenerateBlock___3BII(
173173

174174
if (rng == NULL || buffer == NULL ||
175175
offset < 0 || length < 0 ||
176-
((word32)(offset + length) > bufferSz)) {
176+
(((jlong)offset + (jlong)length) > bufferSz)) {
177177
ret = BAD_FUNC_ARG;
178178
}
179179

0 commit comments

Comments
 (0)