Corrected GCM counter incrementation to use only 32-bits instead of 128-bits
Using 32-bits has the possibility to overwrite the IV in the first 12
bytes of the Y variable.
Found by Yawning Angel
diff --git a/ChangeLog b/ChangeLog
index 75989bb..a5fc141 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,8 @@
= Master
Bugfix
* Fixed memory leak in ssl_free() and ssl_reset() for active session
+ * Corrected GCM counter incrementation to use only 32-bits instead of
+ 128-bits (found by Yawning Angel)
Security
* Removed further timing differences during SSL message decryption in
diff --git a/library/gcm.c b/library/gcm.c
index c91598c..68b6611 100644
--- a/library/gcm.c
+++ b/library/gcm.c
@@ -263,7 +263,7 @@
{
use_len = ( length < 16 ) ? length : 16;
- for( i = 16; i > 0; i-- )
+ for( i = 16; i > 12; i-- )
if( ++y[i - 1] != 0 )
break;