fix a buffer corruption

This commit is contained in:
Max Lv
2015-10-29 19:17:11 +08:00
parent a65c162969
commit 12ff6c8f2f
+9 -5
View File
@@ -1265,11 +1265,15 @@ char * ss_decrypt_all(int buf_size, char *ciphertext, ssize_t *len, int method,
}
if (auth || (plaintext[0] & ONETIMEAUTH_FLAG)) {
char hash[ONETIMEAUTH_BYTES];
memcpy(hash, plaintext + p_len - ONETIMEAUTH_BYTES, ONETIMEAUTH_BYTES);
ret = !ss_onetimeauth_verify(hash, plaintext, p_len - ONETIMEAUTH_BYTES, iv);
if (ret) {
p_len -= ONETIMEAUTH_BYTES;
if (p_len > ONETIMEAUTH_BYTES) {
char hash[ONETIMEAUTH_BYTES];
memcpy(hash, plaintext + p_len - ONETIMEAUTH_BYTES, ONETIMEAUTH_BYTES);
ret = !ss_onetimeauth_verify(hash, plaintext, p_len - ONETIMEAUTH_BYTES, iv);
if (ret) {
p_len -= ONETIMEAUTH_BYTES;
}
} else {
ret = 0;
}
}