drbg: Don't generate more than 2^16 bytes

diff --git a/src/libstrongswan/plugins/drbg/drbg_ctr.c b/src/libstrongswan/plugins/drbg/drbg_ctr.c
index b8c7c124715e675b2f618c04009bd6e3d516e544..a40cf4405e7eafd9227ec199fc68dcc27c285d69 100644 (file)
--- a/src/libstrongswan/plugins/drbg/drbg_ctr.c
+++ b/src/libstrongswan/plugins/drbg/drbg_ctr.c
@@ -15,7 +15,8 @@
 
 #include "drbg_ctr.h"
 
-#define MAX_DRBG_REQUESTS      0xfffffffe
+#define MAX_DRBG_REQUESTS      0xfffffffe      /* 2^32 - 2 */
+#define MAX_DRBG_BYTES         0x00010000      /* 2^19 bits = 2^16 bytes */
 
 typedef struct private_drbg_ctr_t private_drbg_ctr_t;
 
@@ -190,6 +191,12 @@ METHOD(drbg_t, generate, bool,
 {
        chunk_t output;
 
+       if (len > MAX_DRBG_BYTES)
+       {
+               DBG1(DBG_LIB, "DRBG cannot generate more than %d bytes", MAX_DRBG_BYTES);
+               return FALSE;
+       }
+
        if (this->reseed_counter > this->max_requests)
        {
                if (!reseed(this))

diff --git a/src/libstrongswan/plugins/drbg/drbg_hmac.c b/src/libstrongswan/plugins/drbg/drbg_hmac.c
index 353cdcf476cdb045b0e8cfe1c7c6df102cc0bfed..577044dd656293fc2a307d90a93809bfd4e7f329 100644 (file)
--- a/src/libstrongswan/plugins/drbg/drbg_hmac.c
+++ b/src/libstrongswan/plugins/drbg/drbg_hmac.c
@@ -15,7 +15,8 @@
 
 #include "drbg_hmac.h"
 
-#define MAX_DRBG_REQUESTS      0xfffffffe
+#define MAX_DRBG_REQUESTS      0xfffffffe      /* 2^32 - 2 */
+#define MAX_DRBG_BYTES         0x00010000      /* 2^19 bits = 2^16 bytes */
 
 typedef struct private_drbg_hmac_t private_drbg_hmac_t;
 
@@ -158,12 +159,11 @@ METHOD(drbg_t, generate, bool,
        size_t delta;
        chunk_t output;
 
-       DBG2(DBG_LIB, "DRBG generates %u pseudorandom bytes", len);
-       if (!out || len == 0)
+       if (len > MAX_DRBG_BYTES)
        {
+               DBG1(DBG_LIB, "DRBG cannot generate more than %d bytes", MAX_DRBG_BYTES);
                return FALSE;
        }
-       output = chunk_create(out, len);
 
        if (this->reseed_counter > this->max_requests)
        {
@@ -172,6 +172,14 @@ METHOD(drbg_t, generate, bool,
                        return FALSE;
                }
        }
+
+       DBG2(DBG_LIB, "DRBG generates %u pseudorandom bytes", len);
+       if (!out || len == 0)
+       {
+               return FALSE;
+       }
+       output = chunk_create(out, len);
+
        while (len)
        {
                if (!this->prf->get_bytes(this->prf, this->value, this->value.ptr))