updates

[crypto.git] / lib / silccore / silcchannel.c

diff --git a/lib/silccore/silcchannel.c b/lib/silccore/silcchannel.c
index 2bd7eb6fce3351cb8fbee08cc26a0856ba4d7619..83f91977bc1520f6d3f6c79733f60e861c29ed36 100644 (file)
--- a/lib/silccore/silcchannel.c
+++ b/lib/silccore/silcchannel.c
@@ -67,8 +67,9 @@ SilcChannelPayload silc_channel_payload_parse(const unsigned char *payload,
   if (ret == -1)
     goto err;
 
-  if ((newp->name_len < 1 || newp->name_len > buffer.len) ||
-      (newp->id_len < 1 || newp->id_len > buffer.len)) {
+  if ((newp->name_len < 1 || newp->name_len > buffer.len - 8) ||
+      (newp->id_len < 1 || newp->id_len > buffer.len - 8) ||
+      (newp->id_len + newp->name_len > buffer.len - 8)) {
     SILC_LOG_ERROR(("Incorrect channel payload in packet, packet dropped"));
     goto err;
   }
@@ -304,9 +305,18 @@ bool silc_channel_message_payload_decrypt(unsigned char *data,
     silc_hmac_update(hmac, data + (data_len - iv_len), iv_len);
     silc_hmac_final(hmac, mac2, &mac_len);
     if (memcmp(mac, mac2, mac_len)) {
+#if 1
+      /* Backwards support for old mac checking, remove in 1.0 */
+      silc_hmac_make(hmac, dst, (data_len - iv_len - mac_len), mac2, &mac_len);
+      if (memcmp(mac, mac2, mac_len)) {
+#endif
+
       SILC_LOG_DEBUG(("Channel message MACs does not match"));
       silc_free(dst);
       return FALSE;
+#if 1
+      }
+#endif
     }
     SILC_LOG_DEBUG(("MAC is Ok"));
 
@@ -364,7 +374,8 @@ silc_channel_message_payload_parse(unsigned char *payload,
   if (ret == -1)
     goto err;
 
-  if (newp->data_len > buffer.len) {
+  if ((newp->data_len > buffer.len - 6 - mac_len - iv_len) ||
+      (newp->pad_len + newp->data_len > buffer.len - 6 - mac_len - iv_len)) {
     SILC_LOG_ERROR(("Incorrect channel message payload in packet, "
                    "packet dropped"));
     goto err;
@@ -573,7 +584,8 @@ silc_channel_key_payload_parse(const unsigned char *payload,
   if (ret == -1)
     goto err;
 
-  if (newp->id_len < 1 || newp->key_len < 1 || newp->cipher_len < 1) {
+  if (newp->id_len < 1 || newp->key_len < 1 || newp->cipher_len < 1 ||
+      newp->id_len + newp->cipher_len + newp->key_len > buffer.len - 6) {
     SILC_LOG_ERROR(("Incorrect channel key payload in packet"));
     goto err;
   }