[PATCH 6/9] storage: add length check in __storage_decrypt

James Prestwood
2025-04-16T12:34:24Z

The length of EncryptedSecurity was assumed to be at least 16 bytes
and anything less would underflow the length to l_malloc.
---
src/storage.c | 7 +++++++
1 file changed, 7 insertions(+)

diff --git a/src/storage.c b/src/storage.c
index 843581fd..2115a879 100644
--- a/src/storage.c
+++ b/src/storage.c
@@ -500,6 +500,13 @@ int __storage_decrypt(struct l_settings *settings, const char *ssid,
return 0;
}

+ /*
+ * It should likely be far larger than this, but that will get caught
+ * later when reloading the decrypted data.
+ */
+ if (elen < 16)
+ return -EBADMSG;
+
/*
* AES-SIV automatically verifies the IV (16 bytes) and returns only
* the decrypted data portion. We add one here for the NULL terminator
--
2.34.1