From 5b2092a1ec59077b430bd2cab91554cad2eb5128 Mon Sep 17 00:00:00 2001 From: Ryan Harrison Date: Tue, 12 Sep 2017 15:30:55 -0400 Subject: Don't attempt to decrypt AES streams that are too short When reading a stream, if it is encrypted using an AES cipher it must be atleast 16 bytes long aka 128 bits, other wise it is malformed. BUG=chromium:763585 Change-Id: Ied7c36978f1eb24aeda93a184527b6d6a191e5c3 Reviewed-on: https://pdfium-review.googlesource.com/13751 Reviewed-by: Tom Sepez Commit-Queue: Ryan Harrison --- core/fpdfapi/parser/cpdf_crypto_handler.cpp | 4 ++++ core/fpdfapi/parser/cpdf_crypto_handler.h | 1 + core/fpdfapi/parser/cpdf_syntax_parser.cpp | 3 +++ 3 files changed, 8 insertions(+) (limited to 'core/fpdfapi/parser') diff --git a/core/fpdfapi/parser/cpdf_crypto_handler.cpp b/core/fpdfapi/parser/cpdf_crypto_handler.cpp index ef84480c23..74428ba6a8 100644 --- a/core/fpdfapi/parser/cpdf_crypto_handler.cpp +++ b/core/fpdfapi/parser/cpdf_crypto_handler.cpp @@ -297,6 +297,10 @@ bool CPDF_CryptoHandler::Init(int cipher, const uint8_t* key, int keylen) { return true; } +bool CPDF_CryptoHandler::IsCipherAES() const { + return m_Cipher == FXCIPHER_AES; +} + bool CPDF_CryptoHandler::DecryptStream(void* context, const uint8_t* src_buf, uint32_t src_size, diff --git a/core/fpdfapi/parser/cpdf_crypto_handler.h b/core/fpdfapi/parser/cpdf_crypto_handler.h index 14a5743d15..adf0c6c680 100644 --- a/core/fpdfapi/parser/cpdf_crypto_handler.h +++ b/core/fpdfapi/parser/cpdf_crypto_handler.h @@ -48,6 +48,7 @@ class CPDF_CryptoHandler : public CFX_Retainable { uint32_t& dest_size); bool Init(int cipher, const uint8_t* key, int keylen); + bool IsCipherAES() const; private: CPDF_CryptoHandler(); diff --git a/core/fpdfapi/parser/cpdf_syntax_parser.cpp b/core/fpdfapi/parser/cpdf_syntax_parser.cpp index 4a7810fc43..779bf81e0f 100644 --- a/core/fpdfapi/parser/cpdf_syntax_parser.cpp +++ b/core/fpdfapi/parser/cpdf_syntax_parser.cpp @@ -690,6 +690,9 @@ std::unique_ptr CPDF_SyntaxParser::ReadStream( std::unique_ptr pData; if (len > 0) { + if (pCryptoHandler && pCryptoHandler->IsCipherAES() && len < 16) + return nullptr; + pData.reset(FX_Alloc(uint8_t, len)); ReadBlock(pData.get(), len); if (pCryptoHandler) { -- cgit v1.2.3