terl / lazysodium-java

A Java implementation of the Libsodium crypto library. For the lazy dev.
https://github.com/terl/lazysodium-java/wiki
Mozilla Public License 2.0
134 stars 46 forks source link

sodiumHex2Bin silently accepts garbage input #128

Open timmc opened 11 months ago

timmc commented 11 months ago

The implementation hexToBytes accepts non-hex characters and does math on their values as if they are hex chars. For example,ABCD__ and ABCDEF turn into the same bytes. (Character.digit uses a return value of -1 as an error code.)

(EDIT: I had previously thought it didn't fail for an odd number of characters, but it actually does. However, an explicit check would be safer.)