Changeset 60fcd71

Timestamp:

Apr 26, 2010, 7:48:51 PM (14 years ago)

Author:

Nelson Elhage <nelhage@mit.edu>

Branches:

master, release-1.10, release-1.6, release-1.7, release-1.8, release-1.9

Children:

0ee43c8

Parents:

3001c11

git-author:

Nelson Elhage <nelhage@mit.edu> (04/25/10 22:35:13)

git-committer:

Nelson Elhage <nelhage@mit.edu> (04/26/10 19:48:51)

Message:

zcrypt: des_ecb_encrypt doesn't NULL-terminate the output block.

Output is a 'unsigned char [8]', so it couldn't even NULL-terminate it
in place if it wanted to. So copy the decrypted buffer into a larger
buffer that's guaranteed to have a NULL on the end.

File:

• zcrypt.c (modified) (2 diffs)

zcrypt.c

@@ -870 +870 @@
   des_key_schedule schedule;
   unsigned char input[8], output[8];
+  char tmp[9];
   char *keystring;
 
-  output[0] = '\0';    /* In case no message at all                 */
+  /*
+    DES decrypts 8 bytes at a time. We copy those over into the 9-byte
+    'tmp', which has the final byte zeroed, to ensure that we always
+    have a NULL-terminated string we can call printf/strlen on.
+
+    We don't pass 'tmp' to des_ecb_encrypt directly, because it's
+    prototyped as taking 'unsigned char[8]', and this avoids a stupid
+    cast.
+
+    We zero 'tmp' entirely, not just the final byte, in case there are
+    no input blocks.
+  */
+  memset(tmp, 0, sizeof tmp);
 
   keystring = read_keystring(keyfile);
@@ -884 +897 @@
   {
     des_ecb_encrypt(&input, &output, schedule, FALSE);
-    printf("%s", output);
-  }
-
-  if (!output[0] || output[strlen((const char*)output) - 1] != '\n')
+    memcpy(tmp, output, 8);
+    printf("%s", tmp);
+  }
+
+  if (!tmp[0] || tmp[strlen(tmp) - 1] != '\n')
       printf("\n");
   return TRUE;