OpenSystemsDevelopment / qpdf

Commit 932799baab58df23cc1899720fd4637c4360d195

Authored by Jay Berkenbilt
1 parent b6e414b1

Fix memory access error 

A previous fix introduced a potentially memory overrun under certain
rare conditions. The test suite now once again passes with address
sanitizer.
Inline Side-by-side
Showing 1 changed file with 7 additions and 7 deletions
libqpdf/QPDF_encryption.cc
  View file @932799b
@@ -437,11 +437,10 @@ QPDF::compute_encryption_key_from_password( @@ -437,11 +437,10 @@ QPDF::compute_encryption_key_from_password(
437 md5.encodeDataIncrementally(bytes, 4); 437 md5.encodeDataIncrementally(bytes, 4);
438 } 438 }
439 MD5::Digest digest; 439 MD5::Digest digest;
440 - iterate_md5_digest(md5, digest, ((data.getR() >= 3) ? 50 : 0),  
441 - data.getLengthBytes());  
442 - return std::string(reinterpret_cast<char*>(digest),  
443 - std::min(static_cast<int>(sizeof(digest)),  
444 - data.getLengthBytes())); 440 + int key_len = std::min(static_cast<int>(sizeof(digest)),
  441 + data.getLengthBytes());
  442 + iterate_md5_digest(md5, digest, ((data.getR() >= 3) ? 50 : 0), key_len);
  443 + return std::string(reinterpret_cast<char*>(digest), key_len);
445 } 444 }
446 445
447 static void 446 static void
@@ -464,8 +463,9 @@ compute_O_rc4_key(std::string const&amp; user_password, @@ -464,8 +463,9 @@ compute_O_rc4_key(std::string const&amp; user_password,
464 md5.encodeDataIncrementally( 463 md5.encodeDataIncrementally(
465 pad_or_truncate_password_V4(password).c_str(), key_bytes); 464 pad_or_truncate_password_V4(password).c_str(), key_bytes);
466 MD5::Digest digest; 465 MD5::Digest digest;
467 - iterate_md5_digest(md5, digest, ((data.getR() >= 3) ? 50 : 0),  
468 - data.getLengthBytes()); 466 + int key_len = std::min(static_cast<int>(sizeof(digest)),
  467 + data.getLengthBytes());
  468 + iterate_md5_digest(md5, digest, ((data.getR() >= 3) ? 50 : 0), key_len);
469 memcpy(key, digest, OU_key_bytes_V4); 469 memcpy(key, digest, OU_key_bytes_V4);
470 } 470 }
471 471