From dabedd0a110bf6b4ab103ba79a2df36db2b40289 Mon Sep 17 00:00:00 2001
From: Pietro Oliva <pietro.oliva@r3.com>
Date: Wed, 2 Sep 2020 03:22:51 -0400
Subject: [PATCH] Boundary checks improvement: detect when plaintextOffset +
 length is greater than length

---
 .../noise/protocol/AESGCMFallbackCipherState.java             | 4 ++--
 .../southernstorm/noise/protocol/AESGCMOnCtrCipherState.java  | 4 ++--
 .../southernstorm/noise/protocol/ChaChaPolyCipherState.java   | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/main/java/com/southernstorm/noise/protocol/AESGCMFallbackCipherState.java b/src/main/java/com/southernstorm/noise/protocol/AESGCMFallbackCipherState.java
index f627be3..b0ddd0e 100644
--- a/src/main/java/com/southernstorm/noise/protocol/AESGCMFallbackCipherState.java
+++ b/src/main/java/com/southernstorm/noise/protocol/AESGCMFallbackCipherState.java
@@ -187,7 +187,7 @@ class AESGCMFallbackCipherState implements CipherState {
 		int space;
 		if (ciphertextOffset < 0 || ciphertextOffset > ciphertext.length)
 			throw new IllegalArgumentException();
-		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length)
+		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length || plaintextOffset + length > plaintext.length)
 			throw new IllegalArgumentException();
 		space = ciphertext.length - ciphertextOffset;
 		if (!haskey) {
@@ -221,7 +221,7 @@ class AESGCMFallbackCipherState implements CipherState {
 			space = ciphertext.length - ciphertextOffset;
 		if (length > space)
 			throw new ShortBufferException();
-		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length)
+		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length || plaintextOffset + length > plaintext.length)
 			throw new IllegalArgumentException();
 		space = plaintext.length - plaintextOffset;
 		if (!haskey) {
diff --git a/src/main/java/com/southernstorm/noise/protocol/AESGCMOnCtrCipherState.java b/src/main/java/com/southernstorm/noise/protocol/AESGCMOnCtrCipherState.java
index df40945..cb7a4de 100644
--- a/src/main/java/com/southernstorm/noise/protocol/AESGCMOnCtrCipherState.java
+++ b/src/main/java/com/southernstorm/noise/protocol/AESGCMOnCtrCipherState.java
@@ -220,7 +220,7 @@ class AESGCMOnCtrCipherState implements CipherState {
 		int space;
 		if (ciphertextOffset < 0 || ciphertextOffset > ciphertext.length)
 			throw new IllegalArgumentException();
-		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length)
+		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length || plaintextOffset + length > plaintext.length)
 			throw new IllegalArgumentException();
 		space = ciphertext.length - ciphertextOffset;
 		if (keySpec == null) {
@@ -269,7 +269,7 @@ class AESGCMOnCtrCipherState implements CipherState {
 			space = ciphertext.length - ciphertextOffset;
 		if (length > space)
 			throw new ShortBufferException();
-		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length)
+		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length || plaintextOffset + length > plaintext.length)
 			throw new IllegalArgumentException();
 		space = plaintext.length - plaintextOffset;
 		if (keySpec == null) {
diff --git a/src/main/java/com/southernstorm/noise/protocol/ChaChaPolyCipherState.java b/src/main/java/com/southernstorm/noise/protocol/ChaChaPolyCipherState.java
index 40ce2bc..9af4d52 100644
--- a/src/main/java/com/southernstorm/noise/protocol/ChaChaPolyCipherState.java
+++ b/src/main/java/com/southernstorm/noise/protocol/ChaChaPolyCipherState.java
@@ -216,7 +216,7 @@ class ChaChaPolyCipherState implements CipherState {
 		int space;
 		if (ciphertextOffset < 0 || ciphertextOffset > ciphertext.length)
 			throw new IllegalArgumentException();
-		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length)
+		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length || plaintextOffset + length > plaintext.length)
 			throw new IllegalArgumentException();
 		space = ciphertext.length - ciphertextOffset;
 		if (!haskey) {
@@ -248,7 +248,7 @@ class ChaChaPolyCipherState implements CipherState {
 			space = ciphertext.length - ciphertextOffset;
 		if (length > space)
 			throw new ShortBufferException();
-		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length)
+		if (length < 0 || plaintextOffset < 0 || plaintextOffset > plaintext.length || plaintextOffset + length > plaintext.length)
 			throw new IllegalArgumentException();
 		space = plaintext.length - plaintextOffset;
 		if (!haskey) {