Skip to content

{Hash, Hmac}.digest and sign hard crash when supplied 'ucs2' encoding #9817

Description

@deian
  • Version: 6.4.0 - 8.0.0-pre
  • Platform:
  • Subsystem:

Several hash functions hard crash when supplied 'ucs2' encodings.

Snippet for Hash:

    crypto.createHash('sha256').digest('ucs2');

Snippet for Hmac:

    crypto.createHmac('sha256', 'w00t').digest('ucs2');

This is because for both the binding layer functions end up calling
StringBytes::Encode with UCS2, which has a hard check:

  CHECK_NE(encoding, UCS2); // <- this can be controlled from JS
  CHECK_LE(buflen, Buffer::kMaxLength);

The Sign::SignFinal binding function does this too, but the js wrapper always
calls it with the encoding set to null. So you'd have to call handle directly
to crash:

    const private_key = '-----BEGIN EC PRIVATE KEY-----\n' +
      'MHcCAQEEIF+jnWY1D5kbVYDNvxxo/Y+ku2uJPDwS0r/VuPZQrjjVoAoGCCqGSM49\n' +
      'AwEHoUQDQgAEurOxfSxmqIRYzJVagdZfMMSjRNNhB8i3mXyIMq704m2m52FdfKZ2\n' +
      'pQhByd5eyj3lgZ7m7jbchtdgyOF8Io/1ng==\n' +
      '-----END EC PRIVATE KEY-----\n';
    crypto.createSign('RSA-SHA256')._handle.sign(crypto._toBuf(private_key), 'ucs2');

I'm not sure if this was intentional for sign.sign() (to be always called with
null encoding), but I suspect not.

+@mlfbrown for joint work.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    cryptoIssues and PRs related to the crypto subsystem.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions