From 77be4c5f56786ddf5614ced4402240639f98a69f Mon Sep 17 00:00:00 2001 From: Sergey Maslov Date: Thu, 19 Dec 2024 14:50:33 +0300 Subject: [PATCH] Fixed integer overflow in AuthenticatedEncryptionProvider.cs An overflow in the arithmetic expression authenticatedData.Length * 8 with type int(32 bits, signed) can occur before casting into wider type long(64 bits, signed) --- .../Encryption/AuthenticatedEncryptionProvider.cs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Microsoft.IdentityModel.Tokens/Encryption/AuthenticatedEncryptionProvider.cs b/src/Microsoft.IdentityModel.Tokens/Encryption/AuthenticatedEncryptionProvider.cs index a8e38b0b1f..6965c1f0b6 100644 --- a/src/Microsoft.IdentityModel.Tokens/Encryption/AuthenticatedEncryptionProvider.cs +++ b/src/Microsoft.IdentityModel.Tokens/Encryption/AuthenticatedEncryptionProvider.cs @@ -152,7 +152,7 @@ private AuthenticatedEncryptionResult EncryptWithAesCbc(byte[] plaintext, byte[] throw LogHelper.LogExceptionMessage(new SecurityTokenEncryptionFailedException(LogHelper.FormatInvariant(LogMessages.IDX10654, ex))); } - byte[] al = Utility.ConvertToBigEndian(authenticatedData.Length * 8); + byte[] al = Utility.ConvertToBigEndian(authenticatedData.Length * 8L); byte[] macBytes = new byte[authenticatedData.Length + aes.IV.Length + ciphertext.Length + al.Length]; Array.Copy(authenticatedData, 0, macBytes, 0, authenticatedData.Length); Array.Copy(aes.IV, 0, macBytes, authenticatedData.Length, aes.IV.Length); @@ -173,7 +173,7 @@ private byte[] DecryptWithAesCbc(byte[] ciphertext, byte[] authenticatedData, by throw LogHelper.LogExceptionMessage(new SecurityTokenDecryptionFailedException( LogHelper.FormatInvariant(LogMessages.IDX10625, authenticationTag.Length, expectedTagLength, Base64UrlEncoder.Encode(authenticationTag), Algorithm))); - byte[] al = Utility.ConvertToBigEndian(authenticatedData.Length * 8); + byte[] al = Utility.ConvertToBigEndian(authenticatedData.Length * 8L); byte[] macBytes = new byte[authenticatedData.Length + iv.Length + ciphertext.Length + al.Length]; Array.Copy(authenticatedData, 0, macBytes, 0, authenticatedData.Length); Array.Copy(iv, 0, macBytes, authenticatedData.Length, iv.Length);