VeraCrypt
aboutsummaryrefslogtreecommitdiff
path: root/src/Common
diff options
context:
space:
mode:
authorMounir IDRASSI <mounir.idrassi@idrix.fr>2014-08-31 23:56:37 +0200
committerMounir IDRASSI <mounir.idrassi@idrix.fr>2014-11-08 23:23:05 +0100
commit4fa4d6d22708231a51bdff93ef3220aa95b6fc80 (patch)
treee4ad7b2f67f98699c4964f1152120e49329ffb0d /src/Common
parente0efb36f337be3e57e528addd714e10745da6d1f (diff)
downloadVeraCrypt-4fa4d6d22708231a51bdff93ef3220aa95b6fc80.tar.gz
VeraCrypt-4fa4d6d22708231a51bdff93ef3220aa95b6fc80.zip
Windows vulnerability fix: correct possible BSOD attack targeted towards GetWipePassCount() / WipeBuffer() found by the Open Crypto Audit Project.
Diffstat (limited to 'src/Common')
-rw-r--r--src/Common/BootEncryption.cpp2
-rw-r--r--src/Common/Password.c7
-rw-r--r--src/Common/Wipe.c13
3 files changed, 16 insertions, 6 deletions
diff --git a/src/Common/BootEncryption.cpp b/src/Common/BootEncryption.cpp
index e57a434e..9f848fc7 100644
--- a/src/Common/BootEncryption.cpp
+++ b/src/Common/BootEncryption.cpp
@@ -2064,7 +2064,7 @@ namespace VeraCrypt
{
BootEncryptionStatus encStatus = GetStatus();
- if (encStatus.SetupInProgress)
+ if (encStatus.SetupInProgress || (wipePassCount <= 0))
throw ParameterIncorrect (SRC_POS);
SystemDriveConfiguration config = GetSystemDriveConfiguration ();
diff --git a/src/Common/Password.c b/src/Common/Password.c
index c23bd4fa..b1fa83ef 100644
--- a/src/Common/Password.c
+++ b/src/Common/Password.c
@@ -143,6 +143,13 @@ int ChangePwd (const char *lpszVolume, Password *oldPassword, Password *newPassw
if (oldPassword->Length == 0 || newPassword->Length == 0) return -1;
+ if (wipePassCount <= 0)
+ {
+ nStatus = ERR_PARAMETER_INCORRECT;
+ handleError (hwndDlg, nStatus);
+ return nStatus;
+ }
+
if (!lpszVolume)
{
nStatus = ERR_OUTOFMEMORY;
diff --git a/src/Common/Wipe.c b/src/Common/Wipe.c
index f06862e2..d2ee175b 100644
--- a/src/Common/Wipe.c
+++ b/src/Common/Wipe.c
@@ -157,12 +157,9 @@ int GetWipePassCount (WipeAlgorithmId algorithm)
case TC_WIPE_256:
return 256;
-
- default:
- TC_THROW_FATAL_EXCEPTION;
}
- return 0; // Prevent compiler warnings
+ return -1; // Prevent compiler warnings
}
@@ -183,8 +180,14 @@ BOOL WipeBuffer (WipeAlgorithmId algorithm, byte randChars[TC_WIPE_RAND_CHAR_COU
case TC_WIPE_35_GUTMANN:
return Wipe35Gutmann (pass, buffer, size);
+ /* we will never reach here because all calls to WipeBuffer are preceeded
+ * by a call to GetWipePassCount that already checks the same algorithm
+ * parameters and in case of unsupported value an error is returned before
+ * calling WipeBuffer
+ */
+ /*
default:
- TC_THROW_FATAL_EXCEPTION;
+ TC_THROW_FATAL_EXCEPTION;*/
}
return FALSE; // Prevent compiler warnings