OpenSystemsDevelopment / qpdf

Commit 932799baab58df23cc1899720fd4637c4360d195

Authored by Jay Berkenbilt
1 parent b6e414b1

Fix memory access error 

A previous fix introduced a potentially memory overrun under certain
rare conditions. The test suite now once again passes with address
sanitizer.
Inline Side-by-side
Showing 1 changed file with 7 additions and 7 deletions
libqpdf/QPDF_encryption.cc
  View file @932799b
... ... @@ -437,11 +437,10 @@ QPDF::compute_encryption_key_from_password(
437 437 md5.encodeDataIncrementally(bytes, 4);
438 438 }
439 439 MD5::Digest digest;
440   - iterate_md5_digest(md5, digest, ((data.getR() >= 3) ? 50 : 0),
441   - data.getLengthBytes());
442   - return std::string(reinterpret_cast<char*>(digest),
443   - std::min(static_cast<int>(sizeof(digest)),
444   - data.getLengthBytes()));
  440 + int key_len = std::min(static_cast<int>(sizeof(digest)),
  441 + data.getLengthBytes());
  442 + iterate_md5_digest(md5, digest, ((data.getR() >= 3) ? 50 : 0), key_len);
  443 + return std::string(reinterpret_cast<char*>(digest), key_len);
445 444 }
446 445  
447 446 static void
... ... @@ -464,8 +463,9 @@ compute_O_rc4_key(std::string const&amp; user_password,
464 463 md5.encodeDataIncrementally(
465 464 pad_or_truncate_password_V4(password).c_str(), key_bytes);
466 465 MD5::Digest digest;
467   - iterate_md5_digest(md5, digest, ((data.getR() >= 3) ? 50 : 0),
468   - data.getLengthBytes());
  466 + int key_len = std::min(static_cast<int>(sizeof(digest)),
  467 + data.getLengthBytes());
  468 + iterate_md5_digest(md5, digest, ((data.getR() >= 3) ? 50 : 0), key_len);
469 469 memcpy(key, digest, OU_key_bytes_V4);
470 470 }
471 471  
... ...