diff options
| author | Mark Benvenuto <mark.benvenuto@mongodb.com> | 2019-07-24 14:27:00 -0400 |
|---|---|---|
| committer | Mark Benvenuto <mark.benvenuto@mongodb.com> | 2019-07-24 14:27:00 -0400 |
| commit | 260a0ced5d3754f375fee6e220855e722c4b72b8 (patch) | |
| tree | d683fd51d63973a3e6c74faca0a295d1f84912fb /src/mongo/shell | |
| parent | baaa7c25fadcbe4f544a885be4734a0d50ad20d2 (diff) | |
| download | mongo-260a0ced5d3754f375fee6e220855e722c4b72b8.tar.gz | |
SERVER-42318 Tighten bounds on AEAD Decrypt output length
Diffstat (limited to 'src/mongo/shell')
| -rw-r--r-- | src/mongo/shell/encrypted_dbclient_base.cpp | 6 | ||||
| -rw-r--r-- | src/mongo/shell/kms_local.cpp | 3 |
2 files changed, 6 insertions, 3 deletions
diff --git a/src/mongo/shell/encrypted_dbclient_base.cpp b/src/mongo/shell/encrypted_dbclient_base.cpp index c8858f8a9f3..bec5bb8ae5e 100644 --- a/src/mongo/shell/encrypted_dbclient_base.cpp +++ b/src/mongo/shell/encrypted_dbclient_base.cpp @@ -188,7 +188,8 @@ void EncryptedDBClientBase::decryptPayload(ConstDataRange data, UUID uuid = UUID::fromCDR(uuidCdr); auto key = getDataKey(uuid); - std::vector<uint8_t> out(data.length() - kAssociatedDataLength); + std::vector<uint8_t> out(uassertStatusOK( + crypto::aeadGetMaximumPlainTextLength(data.length() - kAssociatedDataLength))); size_t outLen = out.size(); uassertStatusOK( @@ -499,7 +500,8 @@ void EncryptedDBClientBase::decrypt(mozjs::MozJSImplScope* scope, UUID uuid = UUID::fromCDR(uuidCdr); auto key = getDataKey(uuid); - std::vector<uint8_t> out(binData.size() - kAssociatedDataLength); + std::vector<uint8_t> out(uassertStatusOK( + crypto::aeadGetMaximumPlainTextLength(binData.size() - kAssociatedDataLength))); size_t outLen = out.size(); auto decryptStatus = crypto::aeadDecrypt(*key, diff --git a/src/mongo/shell/kms_local.cpp b/src/mongo/shell/kms_local.cpp index e7a090211b3..628ea9ed9c2 100644 --- a/src/mongo/shell/kms_local.cpp +++ b/src/mongo/shell/kms_local.cpp @@ -93,7 +93,8 @@ BSONObj LocalKMSService::encryptDataKey(ConstDataRange cdr, StringData keyId) { } SecureVector<uint8_t> LocalKMSService::decrypt(ConstDataRange cdr, BSONObj masterKey) { - SecureVector<uint8_t> plaintext(cdr.length()); + SecureVector<uint8_t> plaintext( + uassertStatusOK(crypto::aeadGetMaximumPlainTextLength(cdr.length()))); size_t outLen = plaintext->size(); uassertStatusOK(crypto::aeadDecrypt(_key, |