iv-gen: Fail getting shorter IV values than the used counter size
authorMartin Willi <martin@revosec.ch>
Fri, 17 Apr 2015 14:16:45 +0000 (16:16 +0200)
committerAndreas Steffen <andreas.steffen@strongswan.org>
Mon, 1 Jun 2015 07:42:10 +0000 (09:42 +0200)
While no algorithm actually uses such short IVs, we add a check here to ensure
we won't return just the lower bits of the counter.

src/libstrongswan/crypto/iv/iv_gen_seq.c

index 70f1fce..4de1374 100644 (file)
@@ -53,6 +53,10 @@ METHOD(iv_gen_t, get_iv, bool,
        {
                return FALSE;
        }
+       if (size < sizeof(u_int64_t))
+       {
+               return FALSE;
+       }
        if (this->prev != SEQ_IV_INIT_STATE && seq <= this->prev)
        {
                return FALSE;