don't panic: err on output buffer size issues

mcginty · Mar 21, 2017 · c0dc40a · c0dc40a
1 parent 7927a20
commit c0dc40a
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 0 deletions.
diff --git a/src/handshakestate.rs b/src/handshakestate.rs
@@ -205,6 +205,9 @@ impl HandshakeState {
         for token in next_tokens.iter() {
             match *token {
                 Token::E => {
+                    if byte_index + self.e.pub_len() >= message.len() {
+                        return Err(NoiseError::InputError("message does not fit in output buffer"))
+                    }
                     if !self.fixed_ephemeral {
                         self.e.generate(&mut *self.rng);
                     }
@@ -223,6 +226,9 @@ impl HandshakeState {
                     if !self.s.is_on() {
                         return Err(NoiseError::StateError("self.has_s is false"));
                     }
+                    if byte_index + self.s.pub_len() >= message.len() {
+                        return Err(NoiseError::InputError("message does not fit in output buffer"))
+                    }
                     byte_index += self.symmetricstate.encrypt_and_hash(
                         &self.s.pubkey(),
                         &mut message[byte_index..]);
@@ -235,6 +241,9 @@ impl HandshakeState {
         }
 
         self.my_turn = false;
+        if byte_index + payload.len() + TAGLEN >= message.len() {
+            return Err(NoiseError::InputError("message does not fit in output buffer"));
+        }
         byte_index += self.symmetricstate.encrypt_and_hash(payload, &mut message[byte_index..]);
         if byte_index > MAXMSGLEN {
             return Err(NoiseError::InputError("with tokens, message size exceeds maximum"));

diff --git a/tests/lib.rs b/tests/lib.rs
@@ -102,3 +102,21 @@ fn test_sanity_session() {
     let len = h_r.read_message(&buffer_msg[..len], &mut buffer_out).unwrap();
     assert!(&buffer_out[..len] == "hack the planet".as_bytes());
 }
+
+#[test]
+fn test_oversized_handshake_message() {
+    let params: NoiseParams = "Noise_NN_25519_AESGCM_SHA256".parse().unwrap();
+    let mut h_i = NoiseBuilder::new(params).build_initiator().unwrap();
+
+    let mut buffer_out = [0u8; 65535];
+    assert!(h_i.write_message(&[0u8; 65530], &mut buffer_out).is_err());
+}
+
+#[test]
+fn test_undersized_handshake_output_buffer() {
+    let params: NoiseParams = "Noise_NN_25519_AESGCM_SHA256".parse().unwrap();
+    let mut h_i = NoiseBuilder::new(params).build_initiator().unwrap();
+
+    let mut buffer_out = [0u8; 200];
+    assert!(h_i.write_message(&[0u8; 400], &mut buffer_out).is_err());
+}