libutil: Fix buffer overflows in 224-bit SHA - sbase - suckless unix tools
(HTM) git clone git://git.suckless.org/sbase
(DIR) Log
(DIR) Files
(DIR) Refs
(DIR) README
(DIR) LICENSE
---
(DIR) commit 87f4755cd09eecdab7c750a347143cc6fb3b262d
(DIR) parent 1bae669f236b9612eacd64554cfb39733157ef43
(HTM) Author: Santtu Lakkala <inz@inz.fi>
Date: Mon, 3 Nov 2025 17:46:05 +0200
libutil: Fix buffer overflows in 224-bit SHA
Adjust buffer sizes for both SHA-256 and SHA-512 based 224-bit SHA
checksums.
Use a temporary buffer for SHA-512/224, as 224 is not multiple of 64-bit
internal state array of SHA-512.
Diffstat:
M libutil/sha224.c | 2 +-
M libutil/sha512-224.c | 5 ++++-
2 files changed, 5 insertions(+), 2 deletions(-)
---
(DIR) diff --git a/libutil/sha224.c b/libutil/sha224.c
@@ -22,5 +22,5 @@ sha224_init(void *ctx)
void
sha224_sum(void *ctx, uint8_t md[SHA224_DIGEST_LENGTH])
{
- sha256_sum_n(ctx, md, 8);
+ sha256_sum_n(ctx, md, 7);
}
(DIR) diff --git a/libutil/sha512-224.c b/libutil/sha512-224.c
@@ -1,5 +1,6 @@
/* public domain sha512/224 implementation based on fips180-3 */
#include <stdint.h>
+#include <string.h>
#include "../sha512-224.h"
extern void sha512_sum_n(void *, uint8_t *, int n);
@@ -22,5 +23,7 @@ sha512_224_init(void *ctx)
void
sha512_224_sum(void *ctx, uint8_t md[SHA512_224_DIGEST_LENGTH])
{
- sha512_sum_n(ctx, md, 4);
+ uint8_t buf[32];
+ sha512_sum_n(ctx, buf, 4);
+ memcpy(md, buf, SHA512_224_DIGEST_LENGTH);
}