ibmruntimes / openj9-openjdk-jdk

Extensions for OpenJDK for Eclipse OpenJ9
GNU General Public License v2.0
17 stars 73 forks source link

Avoid overlapping buffers in native ChaCha20 #744

Closed jasonkatonica closed 7 months ago

jasonkatonica commented 7 months ago

When using the ChaCha20 algorithms and an input and output buffer overlaps we should ensure that a copy of the input buffer is made before encrypting or decrypting. This ensures that OpenSSL is able to process this data. OpenSSL does not allow for overlapping input and output buffers when performing operations on data for the ChaCha20 algorithm.

The values returned when getting the output size for a crypto operation were also found to be incorrect. This update matches the logic that is within the ChaCha20Cipher.java file for calculating the output sizes.

Encoded key material was found to be left in memory under the right conditions. This memory should be zeroed to avoid a copy of the key from residing in memory for longer than necessary. This addition was noticed when comparing the NativeChaCha20Cipher class to the ChaCha20Cipher class. The method getEncodedKey now will zero out the copy of the key before throwing an exception.

Each of these changes fix the two failing tests reported in issue 18703.

jasonkatonica commented 7 months ago

Please also correct the commit message and the description:

* algorothms -> algorithms

* longer then necessary -> longer than necessary

Updated both the commit message and the github PR description as per above.

keithc-ca commented 7 months ago

If you like, those parentheses I asked you to remove could be restored (in line with the code in ChaCha20Cipher.java), then this should be squashed.

jasonkatonica commented 7 months ago

Reverted just a few portions of this code associated with the parentheses and use of a ternary operator to have it match ChaCha20Cipher. If this looks OK i will proceed with a rebase into a single commit.

keithc-ca commented 7 months ago

I'm happy with the result; please squash.

jasonkatonica commented 7 months ago

I'm happy with the result; please squash.

Rebase/squash complete.

keithc-ca commented 7 months ago

Jenkins copyright check

keithc-ca commented 7 months ago

Jenkins line endings check

keithc-ca commented 7 months ago

Tested locally.