[PATCH] cipher:kdf:argon2: Validate parallelism.
NIIBE Yutaka via Gcrypt-devel <[email protected]>
| Newsgroups | gmane.comp.encryption.gpg.libgcrypt.devel |
|---|---|
| Message-ID | <1d881a41f819cbedbe4dbce8078b8f751cc0e220.1785994518.git.gniibe@fsij.org> |
* cipher/kdf.c (ARGON2_PARALLELISM_MAX): New. (argon2_init): Validate with ARGON2_PARALLELISM_MAX. -- GnuPG-bug-id: 8373 Signed-off-by: NIIBE Yutaka <[email protected]> --- cipher/kdf.c | 6 ++++++ 1 file changed, 6 insertions(+) _______________________________________________ Gcrypt-devel mailing list [email protected] https://lists.gnupg.org/mailman/listinfo/gcrypt-devel
0001-cipher-kdf-argon2-Validate-parallelism.patch
(text/x-patch, 723 B)
diff --git a/cipher/kdf.c b/cipher/kdf.c
index 66eff6c6..2fcfa28b 100644
--- a/cipher/kdf.c
+++ b/cipher/kdf.c
@@ -489,6 +489,9 @@ argon2_fill_first_blocks (argon2_ctx_t a)
return 0;
}
+
+#define ARGON2_PARALLELISM_MAX (16777216-1) /* Section 3.1 of RFC9106 */
+
static gpg_err_code_t
argon2_init (argon2_ctx_t a, unsigned int parallelism,
unsigned int m_cost, unsigned int t_cost)
@@ -500,6 +503,9 @@ argon2_init (argon2_ctx_t a, unsigned int parallelism,
void *block;
struct argon2_thread_data *thread_data;
+ if (parallelism > ARGON2_PARALLELISM_MAX)
+ return GPG_ERR_INV_VALUE;
+
memory_blocks = m_cost;
if (memory_blocks < 8 * parallelism)
memory_blocks = 8 * parallelism;