From 9c9a2ba2db593b203eb66a428fd21f9b26a7d24e Mon Sep 17 00:00:00 2001 From: Daniel Novak Date: Mon, 23 Feb 2026 21:40:17 +0100 Subject: [PATCH 1/2] Fix stack buffer overflow in MACThenDecrypt via block-alignment check Add validation that ciphertext length is a multiple of CIPHER_BLOCK_SIZE before calling decrypt(). The decrypt() function processes data in 16-byte AES blocks, rounding up non-aligned input, which can write up to 8 bytes past the caller's stack buffer. This can be triggered by crafted packets that pass the 2-byte HMAC check (1-in-65536 chance per attempt), enabling a persistent denial-of-service attack against repeaters and other nodes. --- src/Utils.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/Utils.cpp b/src/Utils.cpp index 186c8720..573c4398 100644 --- a/src/Utils.cpp +++ b/src/Utils.cpp @@ -82,7 +82,9 @@ int Utils::MACThenDecrypt(const uint8_t* shared_secret, uint8_t* dest, const uin sha.finalizeHMAC(shared_secret, PUB_KEY_SIZE, hmac, CIPHER_MAC_SIZE); } if (memcmp(hmac, src, CIPHER_MAC_SIZE) == 0) { - return decrypt(shared_secret, dest, src + CIPHER_MAC_SIZE, src_len - CIPHER_MAC_SIZE); + int enc_len = src_len - CIPHER_MAC_SIZE; + if (enc_len % CIPHER_BLOCK_SIZE != 0) return 0; // reject non-block-aligned ciphertext + return decrypt(shared_secret, dest, src + CIPHER_MAC_SIZE, enc_len); } return 0; // invalid HMAC } From b74ba545308f077120cf329f2023f171e2e2f9fa Mon Sep 17 00:00:00 2001 From: Daniel Novak Date: Thu, 26 Feb 2026 09:08:06 +0100 Subject: [PATCH 2/2] Move block-alignment check before HMAC computation Address review feedback: - Move the alignment check before the HMAC-SHA256 computation to skip expensive crypto on obviously malformed packets - Update MACThenDecrypt header comment to document block-alignment as a reason for returning zero --- src/Utils.cpp | 7 ++++--- src/Utils.h | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/src/Utils.cpp b/src/Utils.cpp index 573c4398..a70d4a70 100644 --- a/src/Utils.cpp +++ b/src/Utils.cpp @@ -74,16 +74,17 @@ int Utils::encryptThenMAC(const uint8_t* shared_secret, uint8_t* dest, const uin int Utils::MACThenDecrypt(const uint8_t* shared_secret, uint8_t* dest, const uint8_t* src, int src_len) { if (src_len <= CIPHER_MAC_SIZE) return 0; // invalid src bytes + int enc_len = src_len - CIPHER_MAC_SIZE; + if (enc_len % CIPHER_BLOCK_SIZE != 0) return 0; // reject non-block-aligned ciphertext + uint8_t hmac[CIPHER_MAC_SIZE]; { SHA256 sha; sha.resetHMAC(shared_secret, PUB_KEY_SIZE); - sha.update(src + CIPHER_MAC_SIZE, src_len - CIPHER_MAC_SIZE); + sha.update(src + CIPHER_MAC_SIZE, enc_len); sha.finalizeHMAC(shared_secret, PUB_KEY_SIZE, hmac, CIPHER_MAC_SIZE); } if (memcmp(hmac, src, CIPHER_MAC_SIZE) == 0) { - int enc_len = src_len - CIPHER_MAC_SIZE; - if (enc_len % CIPHER_BLOCK_SIZE != 0) return 0; // reject non-block-aligned ciphertext return decrypt(shared_secret, dest, src + CIPHER_MAC_SIZE, enc_len); } return 0; // invalid HMAC diff --git a/src/Utils.h b/src/Utils.h index 5736b874..9997fe3c 100644 --- a/src/Utils.h +++ b/src/Utils.h @@ -50,7 +50,7 @@ public: /** * \brief checks the MAC (in leading bytes of 'src'), then if valid, decrypts remaining bytes in src. - * \returns zero if MAC is invalid, otherwise the length of decrypted bytes in 'dest' + * \returns zero if MAC is invalid or ciphertext is not block-aligned, otherwise the length of decrypted bytes in 'dest' */ static int MACThenDecrypt(const uint8_t* shared_secret, uint8_t* dest, const uint8_t* src, int src_len);