bitpay / bitcore-lib

A pure and powerful JavaScript Bitcoin library
https://bitcore.io/
Other
613 stars 1.03k forks source link

Wrong length check in HMAC function #219

Open alexdupre opened 6 years ago

alexdupre commented 6 years ago

https://github.com/bitpay/bitcore-lib/blob/026ddb4d393ee5f1daa2688483a13e274d5df3ed/lib/crypto/hash.js#L56

The above check always returns false, since it's missing .length, so the buffer copy/padding is never performed. Luckily/Accidentally accessing an out-of-index array in Javascript returns an undefined type that has the same property of a 0, in regard of the XOR operation.