timoreo/olm
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

megolm: Fix use of uninitialized value in group message decoding.

Browse source 
_olm_decode_group_message should initialize all fields of the results
struct before returning. This is because its caller
_decrypt_max_plaintext_length relies on it having initialized these
fields.

Luckily, this only allows one to subvert the version check in
_decrypt_max_plaintext_length, but not the following check that the
ciphertext field is non-null because that field *is* initialized.
This commit is contained in:
Denis Kasak 2021-05-03 14:01:53 +02:00
parent 0a7b6da9a0
commit c325db02fc
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/message.cpp
View file

@ -373,7 +373,9 @@ void _olm_decode_group_message(
std::uint8_t const * unknown = nullptr;
bool has_message_index = false;
results->version = 0;
results->message_index = 0;
results->has_message_index = (int)has_message_index;
results->ciphertext = nullptr;
results->ciphertext_length = 0;