From 729b0e25be7cfde525489976afc0bdfdb92b7774 Mon Sep 17 00:00:00 2001 From: Ben Wiederhake Date: Mon, 21 Oct 2024 00:43:38 +0200 Subject: [PATCH] LibCrypto: Fix HMAC nullptr deref when key has length 0 While a key of length zero seems like a bad idea in general, the WPT tests end up calling exactly this, so we need to support it one way or another. (cherry picked from commit e1c3e212defe92b4afe36e8184ffda5a08d0abdb) --- Userland/Libraries/LibCrypto/Authentication/HMAC.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Userland/Libraries/LibCrypto/Authentication/HMAC.h b/Userland/Libraries/LibCrypto/Authentication/HMAC.h index 29e353c6e8b..292c8a30084 100644 --- a/Userland/Libraries/LibCrypto/Authentication/HMAC.h +++ b/Userland/Libraries/LibCrypto/Authentication/HMAC.h @@ -98,7 +98,7 @@ private: auto digest = m_inner_hasher.digest(); // FIXME: should we check if the hash function creates more data than its block size? key_buffer.overwrite(0, digest.immutable_data(), m_inner_hasher.digest_size()); - } else { + } else if (length > 0) { key_buffer.overwrite(0, key, length); }