summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRyan Harrison <rharrison@chromium.org>2017-09-12 15:30:55 -0400
committerChromium commit bot <commit-bot@chromium.org>2017-09-12 20:17:27 +0000
commit5b2092a1ec59077b430bd2cab91554cad2eb5128 (patch)
treee7445178ad8133b1d162c61e469be809a3f5e26f
parent8ac74971a33520afb73a8ca6628da1a0a78c85a8 (diff)
downloadpdfium-5b2092a1ec59077b430bd2cab91554cad2eb5128.tar.xz
Don't attempt to decrypt AES streams that are too shortchromium/3214
When reading a stream, if it is encrypted using an AES cipher it must be atleast 16 bytes long aka 128 bits, other wise it is malformed. BUG=chromium:763585 Change-Id: Ied7c36978f1eb24aeda93a184527b6d6a191e5c3 Reviewed-on: https://pdfium-review.googlesource.com/13751 Reviewed-by: Tom Sepez <tsepez@chromium.org> Commit-Queue: Ryan Harrison <rharrison@chromium.org>
-rw-r--r--core/fpdfapi/parser/cpdf_crypto_handler.cpp4
-rw-r--r--core/fpdfapi/parser/cpdf_crypto_handler.h1
-rw-r--r--core/fpdfapi/parser/cpdf_syntax_parser.cpp3
3 files changed, 8 insertions, 0 deletions
diff --git a/core/fpdfapi/parser/cpdf_crypto_handler.cpp b/core/fpdfapi/parser/cpdf_crypto_handler.cpp
index ef84480c23..74428ba6a8 100644
--- a/core/fpdfapi/parser/cpdf_crypto_handler.cpp
+++ b/core/fpdfapi/parser/cpdf_crypto_handler.cpp
@@ -297,6 +297,10 @@ bool CPDF_CryptoHandler::Init(int cipher, const uint8_t* key, int keylen) {
return true;
}
+bool CPDF_CryptoHandler::IsCipherAES() const {
+ return m_Cipher == FXCIPHER_AES;
+}
+
bool CPDF_CryptoHandler::DecryptStream(void* context,
const uint8_t* src_buf,
uint32_t src_size,
diff --git a/core/fpdfapi/parser/cpdf_crypto_handler.h b/core/fpdfapi/parser/cpdf_crypto_handler.h
index 14a5743d15..adf0c6c680 100644
--- a/core/fpdfapi/parser/cpdf_crypto_handler.h
+++ b/core/fpdfapi/parser/cpdf_crypto_handler.h
@@ -48,6 +48,7 @@ class CPDF_CryptoHandler : public CFX_Retainable {
uint32_t& dest_size);
bool Init(int cipher, const uint8_t* key, int keylen);
+ bool IsCipherAES() const;
private:
CPDF_CryptoHandler();
diff --git a/core/fpdfapi/parser/cpdf_syntax_parser.cpp b/core/fpdfapi/parser/cpdf_syntax_parser.cpp
index 4a7810fc43..779bf81e0f 100644
--- a/core/fpdfapi/parser/cpdf_syntax_parser.cpp
+++ b/core/fpdfapi/parser/cpdf_syntax_parser.cpp
@@ -690,6 +690,9 @@ std::unique_ptr<CPDF_Stream> CPDF_SyntaxParser::ReadStream(
std::unique_ptr<uint8_t, FxFreeDeleter> pData;
if (len > 0) {
+ if (pCryptoHandler && pCryptoHandler->IsCipherAES() && len < 16)
+ return nullptr;
+
pData.reset(FX_Alloc(uint8_t, len));
ReadBlock(pData.get(), len);
if (pCryptoHandler) {