From dab102d40478db3ca663920cec28d7311c1691a0 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Sun, 11 Dec 2022 21:07:42 +0100 Subject: [PATCH] On stable, on failed decryption, fill buffer with 0x00 Not with 0xd0, to keep the previous behavior. NSec expicitly checked for that value. --- .../crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c b/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c index 8fe2a79f..907480a3 100644 --- a/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c +++ b/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c @@ -747,7 +747,7 @@ crypto_aead_aes256gcm_encrypt_detached_afternm(unsigned char *c, unsigned char * } gh_required_blocks = required_blocks(ad_len, m_len); if (gh_required_blocks == 0) { - memset(mac, 0xd0, ABYTES); + memset(mac, 0x00, ABYTES); memset(c, 0, m_len); return -1; } @@ -922,7 +922,7 @@ crypto_aead_aes256gcm_decrypt_detached_afternm(unsigned char *m, unsigned char * if (crypto_verify_16(mac, computed_mac) != 0) { sodium_memzero(computed_mac, sizeof computed_mac); - memset(m, 0xd0, m_len); + memset(m, 0x00, m_len); return -1; } return 0;