Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-10076

Coverity, division by zero in KeyStoreCredentialStore (Elytron)

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Critical Critical
    • 7.1.0.DR17
    • 7.1.0.DR15
    • Security
    • None

      Coverity found possible division by zero code.

      https://scan7.coverity.com/reports.htm#v23632/p11778/fileInstanceId=12563831&defectInstanceId=2991543&mergedDefectId=1422738

      KeyStoreCredentialStore.java
              private byte[] pkcs7Pad(byte[] buffer, int blockSize) {
            int len = buffer.length;
            int toFill = blockSize - (len % blockSize);
            byte[] padded = Arrays.copyOf(buffer, toFill + len);
            Arrays.fill(padded, len, padded.length, (byte) toFill);
            return padded;
        }

      blockSize could be 0 as encrypt.getBlockSize() return 0 if used algorithm is not blocked-based. Although default cyptographic algoritm is block-based DEFAULT_CRYPTOGRAPHIC_ALGORITHM = "AES/CBC/NoPadding" , this is configurable with cryptoAlg option and thus non-block-based algorithm can be configured.

              rhn-support-ivassile Ilia Vassilev
              mchoma@redhat.com Martin Choma
              Martin Choma Martin Choma
              Martin Choma Martin Choma
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: