Potential bug in check secret length old code 32-bit
@0-wiz-0,
Are these remnants old 32-bit code? Accidentally forgot to update if check for zip_uint64 max type.
`_zip_crypto_hmac_new` function has an if check `(secret_length > INT_MAX)`. This could be a potential bug if secret_length is of type zip_uint64_t and is then converted to int when HMAC_Init_ex is called. If secret_length is greater than INT_MAX, then truncation will occur, and only 32bit part of the secret will be used.
https://github.com/nih-at/libzip/blob/main/lib/zip_crypto_openssl.c#L134-L140
0 条评论