From a814810a43efeaa4d7a08ad6d9b8ba9fc21a4dba Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Fri, 22 Jan 2016 15:59:54 +0100 Subject: [PATCH] Relax max sizes in argon2 decoding --- src/libsodium/crypto_pwhash/argon2/argon2.c | 8 +++++--- src/libsodium/crypto_pwhash/argon2/argon2.h | 1 + 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/src/libsodium/crypto_pwhash/argon2/argon2.c b/src/libsodium/crypto_pwhash/argon2/argon2.c index 750af34b..92e74bd6 100644 --- a/src/libsodium/crypto_pwhash/argon2/argon2.c +++ b/src/libsodium/crypto_pwhash/argon2/argon2.c @@ -177,13 +177,15 @@ int argon2_verify(const char *encoded, const void *pwd, const size_t pwdlen, argon2_context ctx; uint8_t *out; int ret; + uint32_t encoded_len; memset(&ctx, 0, sizeof ctx); /* max values, to be updated in decode_string */ - ctx.adlen = 512; - ctx.saltlen = 512; - ctx.outlen = 512; + encoded_len = strlen(encoded); + ctx.adlen = encoded_len; + ctx.saltlen = encoded_len; + ctx.outlen = encoded_len; ctx.ad = (uint8_t *) malloc(ctx.adlen); ctx.salt = (uint8_t *) malloc(ctx.saltlen); diff --git a/src/libsodium/crypto_pwhash/argon2/argon2.h b/src/libsodium/crypto_pwhash/argon2/argon2.h index 46401161..c5ef76a5 100644 --- a/src/libsodium/crypto_pwhash/argon2/argon2.h +++ b/src/libsodium/crypto_pwhash/argon2/argon2.h @@ -240,6 +240,7 @@ int argon2_hash(const uint32_t t_cost, const uint32_t m_cost, /** * Verifies a password against an encoded string + * Encoded string is restricted as in validate_inputs() * @param encoded String encoding parameters, salt, hash * @param pwd Pointer to password * @pre Returns ARGON2_OK if successful