Skip to content

{Hash, Hmac}.digest and sign hard crash when supplied 'ucs2' encoding #9817

Closed
@deian

Description

@deian
  • Version: 6.4.0 - 8.0.0-pre
  • Platform:
  • Subsystem:

Several hash functions hard crash when supplied 'ucs2' encodings.

Snippet for Hash:

    crypto.createHash('sha256').digest('ucs2');

Snippet for Hmac:

    crypto.createHmac('sha256', 'w00t').digest('ucs2');

This is because for both the binding layer functions end up calling
StringBytes::Encode with UCS2, which has a hard check:

  CHECK_NE(encoding, UCS2); // <- this can be controlled from JS
  CHECK_LE(buflen, Buffer::kMaxLength);

The Sign::SignFinal binding function does this too, but the js wrapper always
calls it with the encoding set to null. So you'd have to call handle directly
to crash:

    const private_key = '-----BEGIN EC PRIVATE KEY-----\n' +
      'MHcCAQEEIF+jnWY1D5kbVYDNvxxo/Y+ku2uJPDwS0r/VuPZQrjjVoAoGCCqGSM49\n' +
      'AwEHoUQDQgAEurOxfSxmqIRYzJVagdZfMMSjRNNhB8i3mXyIMq704m2m52FdfKZ2\n' +
      'pQhByd5eyj3lgZ7m7jbchtdgyOF8Io/1ng==\n' +
      '-----END EC PRIVATE KEY-----\n';
    crypto.createSign('RSA-SHA256')._handle.sign(crypto._toBuf(private_key), 'ucs2');

I'm not sure if this was intentional for sign.sign() (to be always called with
null encoding), but I suspect not.

+@mlfbrown for joint work.

Metadata

Metadata

Assignees

No one assigned

    Labels

    cryptoIssues and PRs related to the crypto subsystem.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions