1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
|
/* Copyright (C) 2001-2023 Artifex Software, Inc.
All Rights Reserved.
This software is provided AS-IS with no warranty, either express or
implied.
This software is distributed under license and may not be copied,
modified or distributed except as expressly authorized under the terms
of the license contained in the file LICENSE in this distribution.
Refer to licensing information at http://www.artifex.com or contact
Artifex Software, Inc., 39 Mesa Street, Suite 108A, San Francisco,
CA 94129, USA, for further information.
*/
/* AES filter implementation */
#include "memory_.h"
#include "gserrors.h"
#include "strimpl.h"
#include "saes.h"
/* stream implementation */
private_st_aes_state(); /* creates a gc object for our state,
defined in saes.h */
/* Store a key in our crypt context */
int
s_aes_set_key(stream_aes_state * state, const unsigned char *key,
int keylength)
{
int code = 0;
if ( (keylength < 1) || (keylength > SAES_MAX_KEYLENGTH) )
return_error(gs_error_rangecheck);
if (key == NULL)
return_error(gs_error_invalidaccess);
/* we can't set the key here because the interpreter's
filter implementation wants to duplicate our state
after the zfaes.c binding calls us. So stash it now
and handle it in our process method. */
memcpy(state->key, key, keylength);
state->keylength = keylength;
if (code) {
return gs_throw(gs_error_rangecheck, "could not set AES key");
}
/* return successfully */
return 0;
}
/* Specify whether the plaintext stream uses RFC 1423-style padding
* (allowing it to be an arbitrary length), or is unpadded (and must
* therefore be a multiple of 16 bytes long). */
void
s_aes_set_padding(stream_aes_state *state, int use_padding)
{
state->use_padding = use_padding;
}
/* initialize our state object. */
static int
s_aes_init(stream_state *ss)
{
stream_aes_state *const state = (stream_aes_state *) ss;
/* clear the flags so we know we're at the start of a stream */
state->initialized = 0;
state->ctx = NULL;
return 0;
}
/* release our private storage */
static void
s_aes_release(stream_state *ss)
{
stream_aes_state *const state = (stream_aes_state *) ss;
if (state->ctx != NULL)
gs_free_object(state->memory, state->ctx, "aes context structure");
}
/* (de)crypt a section of text--the procedure is the same
* in each direction. see strimpl.h for return codes.
*/
static int
s_aes_process(stream_state * ss, stream_cursor_read * pr,
stream_cursor_write * pw, bool last)
{
stream_aes_state *const state = (stream_aes_state *) ss;
const unsigned char *limit;
const long in_size = pr->limit - pr->ptr;
const long out_size = pw->limit - pw->ptr;
unsigned char temp[16];
int status = 0;
/* figure out if we're going to run out of space */
if (in_size > out_size) {
limit = pr->ptr + out_size;
status = 1; /* need more output space */
} else {
limit = pr->limit;
status = last ? EOFC : 0; /* need more input */
}
/* set up state and context */
if (state->ctx == NULL) {
/* allocate the aes context. this is a public struct but it
contains internal pointers, so we need to store it separately
in immovable memory like any opaque structure. */
state->ctx = (aes_context *)gs_alloc_bytes_immovable(state->memory,
sizeof(aes_context), "aes context structure");
if (state->ctx == NULL) {
gs_throw(gs_error_VMerror, "could not allocate aes context");
return ERRC;
}
memset(state->ctx, 0x00, sizeof(aes_context));
if (state->keylength < 1 || state->keylength > SAES_MAX_KEYLENGTH) {
gs_throw1(gs_error_rangecheck, "invalid aes key length (%d bytes)",
state->keylength);
return ERRC;
}
aes_setkey_dec(state->ctx, state->key, state->keylength * 8);
}
if (!state->initialized) {
/* read the initialization vector from the first 16 bytes */
if (in_size < 16) return 0; /* get more data */
memcpy(state->iv, pr->ptr + 1, 16);
state->initialized = 1;
pr->ptr += 16;
}
/* decrypt available blocks */
while (pr->ptr + 16 <= limit) {
aes_crypt_cbc(state->ctx, AES_DECRYPT, 16, state->iv,
pr->ptr + 1, temp);
pr->ptr += 16;
if (last && pr->ptr == pr->limit) {
/* we're on the last block; unpad if necessary */
int pad;
if (state->use_padding) {
/* we are using RFC 1423-style padding, so the last byte of the
plaintext gives the number of bytes to discard */
pad = temp[15];
if (pad < 1 || pad > 16) {
/* Bug 692343 - don't error here, just warn. Take padding to be
* zero. This may give us a stream that's too long - preferable
* to the alternatives. */
gs_warn1("invalid aes padding byte (0x%02x)",
(unsigned char)pad);
pad = 0;
}
} else {
/* not using padding */
pad = 0;
}
memcpy(pw->ptr + 1, temp, 16 - pad);
pw->ptr += 16 - pad;
return EOFC;
}
memcpy(pw->ptr + 1, temp, 16);
pw->ptr += 16;
}
/* if we got to the end of the file without triggering the padding
check, the input must not have been a multiple of 16 bytes long.
complain. */
if (status == EOFC) {
gs_throw(gs_error_rangecheck, "aes stream isn't a multiple of 16 bytes");
return 0;
}
return status;
}
/* stream template */
const stream_template s_aes_template = {
&st_aes_state, s_aes_init,
s_aes_process, 16, 16,
s_aes_release
};
|
