Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Range Check Exception when using KDF with empty password

Abierto
  • ¿Algo no está bien?
#76 4 comentarios 0 reacciones 1 asignado Ver en GitHub

@MHumm ya está trabajando en esto.

Desde el 12/5/2024.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

bug help wanted

In my app, I noticed a "Range Check Exception" when the user didn't enter a password (which I clearly forgot to check), and therefore the, empty password was tried to be processed through KDF. The reason for the Range Check Exception is that Data[0] is accessed, which does not exist if Data is empty.

class function TDECHashAuthentication.KDFx(const Data, Seed: TBytes;
                                           MaskSize: Integer;
                                           Index: UInt32 = 1): TBytes;
begin
  if (length(Seed) > 0) then
    Result := KDFx(Data[0], Length(Data), Seed[0], Length(Seed), MaskSize, Index)
  else
    Result := KDFx(Data[0], Length(Data), NullStr, Length(Seed), MaskSize, Index)
end;

(This is just an example. Not only KDFx is affected. Other methods are affected too.)

It is dangerous that a method can fail this way, especially because "range check" can be disabled in the compiler settings for performance reasons.

In my opinion we should do the following: Find out (from official sources / reference implementation) what KDF123x/PBKDF/MGF1 is supposed to do if the input is 0 bytes. Is it supposed to fail, or is it supposed to return a key "X"?

  • If it shall output a key "X", then we should implement it this way
  • If it is supposed to fail, then we must throw an Exception instead of risking a memory-corruption if range checks are disabled

(edit: typo. of course I meant "instead of risking")

Lenguaje dominante
HTML
Estrellas
286
Forks
78
Merge medio
1 d 4 h
PR fusionados (30 d)
4

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de MHumm/DelphiEncryptionCompendium

Todos los issues de MHumm/DelphiEncryptionCompendium

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.