From fc3eb1ecb44d026823fc829dfc43e95c09d6bdb5 Mon Sep 17 00:00:00 2001 From: Wessel Nieboer Date: Fri, 13 Feb 2026 00:38:26 +0100 Subject: [PATCH] Add comment about ECB path failure --- src/Utils.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/Utils.cpp b/src/Utils.cpp index 82882b2c..d7b1b324 100644 --- a/src/Utils.cpp +++ b/src/Utils.cpp @@ -85,7 +85,9 @@ int Utils::MACThenDecrypt(const uint8_t* shared_secret, uint8_t* dest, const uin if (memcmp(hmac, src, CIPHER_MAC_SIZE) == 0) { return decrypt(shared_secret, dest, src + CIPHER_MAC_SIZE, src_len - CIPHER_MAC_SIZE); } - return 0; // invalid HMAC + // No need to zero dest on failure — MAC is checked before decryption, + // so dest is never written to when authentication fails. + return 0; } /*