From cf04aaa95494dc9b7ef1f868924e87be644cd2b1 Mon Sep 17 00:00:00 2001 From: Wessel Nieboer Date: Thu, 12 Feb 2026 01:48:42 +0100 Subject: [PATCH] Fix AEAD-4 payload size check and nonce wrap-around --- src/Mesh.cpp | 3 ++- src/helpers/ContactInfo.h | 5 ++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/Mesh.cpp b/src/Mesh.cpp index e670c808d..7fc21fde5 100644 --- a/src/Mesh.cpp +++ b/src/Mesh.cpp @@ -522,8 +522,9 @@ Packet* Mesh::createPathReturn(const uint8_t* dest_hash, const uint8_t* secret, Packet* Mesh::createDatagram(uint8_t type, const Identity& dest, const uint8_t* secret, const uint8_t* data, size_t data_len, uint16_t aead_nonce) { if (type == PAYLOAD_TYPE_TXT_MSG || type == PAYLOAD_TYPE_REQ || type == PAYLOAD_TYPE_RESPONSE) { + size_t hash_prefix = PATH_HASH_SIZE * 2; // dest_hash + src_hash size_t max_overhead = aead_nonce ? (AEAD_NONCE_SIZE + AEAD_TAG_SIZE) : (CIPHER_MAC_SIZE + CIPHER_BLOCK_SIZE-1); - if (data_len + max_overhead > MAX_PACKET_PAYLOAD) return NULL; + if (data_len + hash_prefix + max_overhead > MAX_PACKET_PAYLOAD) return NULL; } else { return NULL; // invalid type } diff --git a/src/helpers/ContactInfo.h b/src/helpers/ContactInfo.h index 864329910..595c464c6 100644 --- a/src/helpers/ContactInfo.h +++ b/src/helpers/ContactInfo.h @@ -22,7 +22,10 @@ struct ContactInfo { // Returns next AEAD nonce (post-increment) if peer supports AEAD, 0 otherwise. // When 0, callers use ECB encryption. uint16_t nextAeadNonce() const { - if (flags & CONTACT_FLAG_AEAD) return ++aead_nonce; + if (flags & CONTACT_FLAG_AEAD) { + if (++aead_nonce == 0) ++aead_nonce; // skip 0 (sentinel for ECB) + return aead_nonce; + } return 0; }