From 4b1478cd5b7016c5d808dda4703a3a32cbee389d Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Sun, 25 Oct 2015 01:57:07 +0200
Subject: [PATCH] Extra sanity checks for blake2b_salt_personal()

---
 .../blake2/ref/blake2b-ref.c                  | 22 +++++++++++--------
 test/default/generichash3.exp                 |  2 +-
 2 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/src/libsodium/crypto_generichash/blake2/ref/blake2b-ref.c b/src/libsodium/crypto_generichash/blake2/ref/blake2b-ref.c
index 31447325..ab828c8e 100644
--- a/src/libsodium/crypto_generichash/blake2/ref/blake2b-ref.c
+++ b/src/libsodium/crypto_generichash/blake2/ref/blake2b-ref.c
@@ -57,7 +57,7 @@ static inline int blake2b_clear_lastnode( blake2b_state *S )
   return 0;
 }
 #endif
-/* Some helper functions, not necessarily useful */
+
 static inline int blake2b_set_lastblock( blake2b_state *S )
 {
   if( S->last_node ) blake2b_set_lastnode( S );
@@ -389,7 +389,7 @@ int blake2b_final( blake2b_state *S, uint8_t *out, uint8_t outlen )
   uint8_t buffer[BLAKE2B_OUTBYTES];
   int     i;
 
-  if( outlen > BLAKE2B_OUTBYTES ) {
+  if( !outlen || outlen > BLAKE2B_OUTBYTES ) {
     return -1;
   }
   if( S->buflen > BLAKE2B_BLOCKBYTES )
@@ -418,14 +418,14 @@ int blake2b( uint8_t *out, const void *in, const void *key, const uint8_t outlen
   blake2b_state S[1];
 
   /* Verify parameters */
-  if ( NULL == in && inlen > 0 ) return -1;
+  if( NULL == in && inlen > 0 ) return -1;
 
-  if ( NULL == out ) return -1;
-
-  if( NULL == key && keylen > 0 ) return -1;
+  if( NULL == out ) return -1;
 
   if( !outlen || outlen > BLAKE2B_OUTBYTES ) return -1;
 
+  if( NULL == key && keylen > 0 ) return -1;
+
   if( keylen > BLAKE2B_KEYBYTES ) return -1;
 
   if( keylen > 0 )
@@ -448,11 +448,15 @@ int blake2b_salt_personal( uint8_t *out, const void *in, const void *key, const
   blake2b_state S[1];
 
   /* Verify parameters */
-  if ( NULL == in ) return -1;
+  if( NULL == in && inlen > 0 ) return -1;
 
-  if ( NULL == out ) return -1;
+  if( NULL == out ) return -1;
 
-  if( NULL == key ) keylen = 0;
+  if( !outlen || outlen > BLAKE2B_OUTBYTES ) return -1;
+
+  if( NULL == key && keylen > 0 ) return -1;
+
+  if( keylen > BLAKE2B_KEYBYTES ) return -1;
 
   if( keylen > 0 )
   {
diff --git a/test/default/generichash3.exp b/test/default/generichash3.exp
index 75a62d43..3123c2bc 100644
--- a/test/default/generichash3.exp
+++ b/test/default/generichash3.exp
@@ -67,7 +67,7 @@ c6d6722a916651a8671383d8260873347d9c248696b4cb3dac4dea9ba57ed971127cb18e44211d7e
 5789f474edd5206ededaccfc35e7dd3ed730748125b5395abf802b2601126b19b109a1db67556945bc79bb25e1ab59610599d155070e0e04354f11a6a5d6f3ac
 e78efc663a5547c089f2b3b08973c974c4bfd365eac18b80c68bdb3b1ba4554b54d6b8465a68a3b9aa0bc020621f16efd5b8dd8c7c01ed9ee3ec5544aae465ff
 1afc8ec818bef0a479d2b4cac81d40a52cafa27f6d80c42fc23cbaf4141882ab59ab1101922fcb6e707ef2f61efd07cce5d09094e6bee420b1b96998c7cee96d
-1afc8ec818bef0a479d2b4cac81d40a52cafa27f6d80c42fc23cbaf4141882ab59ab1101922fcb6e707ef2f61efd07cce5d09094e6bee420b1b96998c7cee96d
+00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
 fb4e2ad6b7fe6afd2ba06d5c1d79379c5bf10e336a35c89a1aaf408a805171716e0635a5b1d18190131e15b6888510bcb3e3752b050f892a09dbbde60b051495
 5789f474edd5206ededaccfc35e7dd3ed730748125b5395abf802b2601126b19b109a1db67556945bc79bb25e1ab59610599d155070e0e04354f11a6a5d6f3ac
 e78efc663a5547c089f2b3b08973c974c4bfd365eac18b80c68bdb3b1ba4554b54d6b8465a68a3b9aa0bc020621f16efd5b8dd8c7c01ed9ee3ec5544aae465ff