sysutils/winscp
1
0
Fork 0
mirror of https://github.com/winscp/winscp.git synced 2026-10-24 02:28:55 +03:00
Code Activity

Issue 2449 – Heap over-read via crafted encrypted filename

Browse Source 
https://winscp.net/tracker/2449

Source commit: b3d37ef6d446a33900eb2ba2e911d1134c1bd312
This commit is contained in:
Martin Prikryl
2026-06-12 14:44:54 +00:00
parent dc56db76b1
commit 927e5f538a
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
source/core/Cryptography.cpp
View File

@@ -907,7 +907,12 @@ UnicodeString TEncryption::DecryptFileName(const UnicodeString & FileName)
Base64 += UnicodeString::StringOfChar(L'=', Padding);
}
RawByteString Buffer = DecodeBase64ToStr(Base64);
FSalt = Buffer.SubString(1, SALT_LENGTH(PASSWORD_MANAGER_AES_MODE));
int SaltLength = SALT_LENGTH(PASSWORD_MANAGER_AES_MODE);
if (Buffer.Length() <= SaltLength)
{
throw Exception(L"Empty encrypted filename");
}
FSalt = Buffer.SubString(1, SaltLength);
SetSalt();
Buffer.Delete(1, FSalt.Length());
Aes(Buffer);
@@ -917,7 +922,10 @@ UnicodeString TEncryption::DecryptFileName(const UnicodeString & FileName)
//---------------------------------------------------------------------------
bool TEncryption::IsEncryptedFileName(const UnicodeString & FileName)
{
return EndsStr(AesCtrExt, FileName);
const int SaltBase64Len = (4 * SALT_LENGTH(PASSWORD_MANAGER_AES_MODE) + 2) / 3;
return
EndsStr(AesCtrExt, FileName) &&
(FileName.Length() > AesCtrExt.Length() + SaltBase64Len);
}
//---------------------------------------------------------------------------
int TEncryption::GetOverhead()