[Git][NTPsec/ntpsec][master] ntpd/nts_extens.c: bound client AEEF noncelen by the remaining buffer

[Matt Selsky (@selsky)]

Matt Selsky pushed to branch master at NTPsec / ntpsec


Commits:
a6f78320 by Matt Selsky at 2026-10-07T01:23:55+00:00
ntpd/nts_extens.c: bound client AEEF noncelen by the remaining buffer

extens_client_recv() checked noncelen + CMAC_LENGTH against length, which was
captured before the two next_uint16() reads consumed 4 bytes of buf.left. A
server response could pass that check while buf.left was up to 4 bytes short,
making outlen = buf.left - noncelen - CMAC_LENGTH negative before it is stored
in a size_t.

AES_SIV_Decrypt() rejects the resulting ciphertext length before dereferencing
anything, so this is not exploitable, but we want the check if/when we remove
libaes_siv.

Require noncelen == NONCE_LENGTH, matching the server-side check 7cc079387
("Fix #895"), and check noncelen + CMAC_LENGTH against buf.left.

Reported in NTPsec/ntpsec#895.

- - - - -


1 changed file:

- ntpd/nts_extens.c


Changes:

=====================================
ntpd/nts_extens.c
=====================================
@@ -412,13 +412,15 @@ bool extens_client_recv(struct peer *peer, uint8_t *pkt, int lng) {
                                 return false;        // garbage packet
                         noncelen = next_uint16(&buf);
                         outlen = next_uint16(&buf);
-                        if (noncelen&3 || outlen&3)
+                        if (NONCE_LENGTH != noncelen)
+                                return false;        // garbage packet
+                        if (outlen&3)
                                 return false;        // else round up
+                        if (noncelen+CMAC_LENGTH > buf.left)
+                                return false;        // garbage packet
                         nonce = buf.next;
                         ciphertext = nonce+noncelen;
                         plaintext = ciphertext+CMAC_LENGTH;
-                        if (noncelen+CMAC_LENGTH > length)
-                                return false;        // garbage packet
                         outlen = buf.left-noncelen-CMAC_LENGTH;
                         //  printf("ECRa: %lu, %d\n", (long unsigned)outlen,
                        //          noncelen);



View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/a6f78320e2e65fae9d135154f4db9d69c6429299

-- 
View it on GitLab: https://gitlab.com/NTPsec/ntpsec/-/commit/a6f78320e2e65fae9d135154f4db9d69c6429299
You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ntpsec.org/pipermail/vc/attachments/20261007/16a66eaa/attachment-0001.htm>