This repository has been archived by the owner on Jan 23, 2023. It is now read-only.
Provide a temporary RSA decryption buffer when dest is too small #36601
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
stephentoub
reviewed
Apr 4, 2019
|
|
||
| if (ret) | ||
| { | ||
| Span<byte> tmpSlice = tmp.Slice(0, bytesWritten); |
There was a problem hiding this comment.
Why not just tmp = tmp.Slice(0, bytesWritten);?
stephentoub
reviewed
Apr 4, 2019
|
|
||
| if (rent != null) | ||
| { | ||
| // Already cleared |
There was a problem hiding this comment.
I assume this means that if TryDecrypt fails, it won't have written anything to the buffer?
stephentoub
approved these changes
Apr 4, 2019
krwq
reviewed
Apr 4, 2019
| // To prevent the OOB write, decrypt into a temporary buffer. | ||
| if (destination.Length < keySizeBytes) | ||
| { | ||
| Span<byte> tmp = stackalloc byte[0]; |
There was a problem hiding this comment.
why is the stackalloc needed here? (or could you remove the initialization?)
There was a problem hiding this comment.
without this the tmp variable is not allowed to receive the stackalloc from within the if (it's a compile error to remove this).
krwq
approved these changes
Apr 4, 2019
picenka21
pushed a commit
to picenka21/runtime
that referenced
this pull request
Feb 18, 2022
…net/corefx#36601) * Provide a temporary RSA decryption buffer when dest is too small * Remove the semi-redundant second span variable * Add tests to ensure that destination is not tainted when decryption fails * Make Decrypt_WrongKey_OAEP_SHA256 conditional Commit migrated from dotnet/corefx@df5bba1
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #33561.