diff options
author | Jakob Unterwurzacher | 2017-05-23 20:46:24 +0200 |
---|---|---|
committer | Jakob Unterwurzacher | 2017-05-23 21:26:38 +0200 |
commit | e827763f2e6226d9f5778d56c28270264950c0f5 (patch) | |
tree | 2f5f4adeed482dd473cc4714b97a8903806fdbb3 /mount.go | |
parent | 508fd9e1d64131958c86175cb8d848f730e629cf (diff) |
nametransform: harden name decryption against invalid input
This fixes a few issues I have found reviewing the code:
1) Limit the amount of data ReadLongName() will read. Previously,
you could send gocryptfs into out-of-memory by symlinking
gocryptfs.diriv to /dev/zero.
2) Handle the empty input case in unPad16() by returning an
error. Previously, it would panic with an out-of-bounds array
read. It is unclear to me if this could actually be triggered.
3) Reject empty names after base64-decoding in DecryptName().
An empty name crashes emeCipher.Decrypt().
It is unclear to me if B64.DecodeString() can actually return
a non-error empty result, but let's guard against it anyway.
Diffstat (limited to 'mount.go')
0 files changed, 0 insertions, 0 deletions