From 2ad93674dc180e085e29d4986800f8cac9bb4891 Mon Sep 17 00:00:00 2001 From: Paul Elliott Date: Fri, 11 Aug 2023 11:07:06 +0100 Subject: [PATCH] Fix potential corruption of IV for AES CBC If passed a zero length, AES CBC could potentially corrupt the passed in IV by memcpying it over itself. Although this might be ok with more recent compilers, its not for every compiler we support. Found by coverity. Signed-off-by: Paul Elliott --- library/aes.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/library/aes.c b/library/aes.c index 592ca6416f..b55c08ab1e 100644 --- a/library/aes.c +++ b/library/aes.c @@ -1094,6 +1094,11 @@ int mbedtls_aes_crypt_cbc(mbedtls_aes_context *ctx, return MBEDTLS_ERR_AES_BAD_INPUT_DATA; } + /* Nothing to do if length is zero. */ + if (length == 0) { + return 0; + } + if (length % 16) { return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH; }