bricke / Qt-AES

Native Qt AES encryption class
The Unlicense
501 stars 187 forks source link

QByteArray index out of bound #34

Closed Trikos closed 4 years ago

Trikos commented 4 years ago

Hi, im using your source in my project and installing the app in Android 7. THe code crash with this error: A/MyApp: ASSERT: "uint(i) < uint(size())" in file C:\Qt\5.13.2\android_armv7\include\QtCore/qbytearray.h, line 481 A/libc: Fatal signal 6 (SIGABRT), code -6 in tid 28083 (qtMainLoopThrea)

Doing a lot of Debugging I arrived in expandedKey method: row 218-> QByteArray roundKey(key); //The size of this element is 15 row 222-> m_nk = 4, m_nb = 4, m_nr = 10

for(i = m_nk; i < m_nb * (m_nr + 1); i++) { tempa[0] = (quint8) roundKey.at((i-1) * 4 + 0); tempa[1] = (quint8) roundKey.at((i-1) * 4 + 1); tempa[2] = (quint8) roundKey.at((i-1) * 4 + 2); tempa[3] = (quint8) roundKey.at((i-1) * 4 + 3);

When the code reach tempa[3] at row 227 with roundKey.at(), It tries to access the 15 element and goes into FATAL because the first loop is i = 4 so => (4-1) * 4 + 3 = 15 and roundKey last index is 14. What can I do? I always use your class with my Android 9-10 and have no problem at all. Today I broke my phone and I used an old one and get this drama. Hope my LOG can help you understand the problem, let me know as soon as you can

bricke commented 4 years ago

Do you have the code to reproduce this? How long is your key?

Trikos commented 4 years ago

My mistake. It accepts only 16 digits long and it wasnt 16 digits long. Will you change this in future?

bricke commented 4 years ago

No, a 128b long key is a requirement of AES-128. Adding bits to fit a shorter key will create compatibility issues down the road.

What I could do is to alert the user if the key is not long enough