godaddy / asherah

Asherah is a multi-language, cross-platform application encryption SDK
MIT License
75 stars 47 forks source link

Input validation and improved memory utilization #932

Closed aka-bo closed 1 year ago

aka-bo commented 1 year ago

To help us get this pull request reviewed and merged quickly, please be sure to include the following items:

PR Type

What kind of change does this PR introduce?

Backward Compatibility

Is this change backward compatible with the most recently released version? Does it introduce changes which might change the user experience in any way? Does it alter the API in any way?

What's new?

Input validation updated to include explicit guards around the computed size of the slice used for plaintext storage. These guards prevent integer overflow and esure the size of the input data is supported by the cipher.

Additionally, ciphertext storage is now reused for the decrypted output, reducing overall memory utilization for decrypt operations.