iv-gen: Fail getting shorter IV values than the used counter size

While no algorithm actually uses such short IVs, we add a check here to ensure
we won't return just the lower bits of the counter.

diff --git a/src/libstrongswan/crypto/iv/iv_gen_seq.c b/src/libstrongswan/crypto/iv/iv_gen_seq.c
index 70f1fce389113992231dc9a6e4a5da32e04d051a..4de13744d92a94b1dff6b5c0b247577fcf854d0c 100644 (file)
--- a/src/libstrongswan/crypto/iv/iv_gen_seq.c
+++ b/src/libstrongswan/crypto/iv/iv_gen_seq.c
@@ -53,6 +53,10 @@ METHOD(iv_gen_t, get_iv, bool,
        {
                return FALSE;
        }
+       if (size < sizeof(u_int64_t))
+       {
+               return FALSE;
+       }
        if (this->prev != SEQ_IV_INIT_STATE && seq <= this->prev)
        {
                return FALSE;