Shikong/Clash.Meta
1
0
Fork 0
mirror of https://gitclone.com/github.com/MetaCubeX/Clash.Meta synced 2025-02-23 20:52:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: add length check for ssr auth_aes128_sha1 (#2129)

Browse Source
This commit is contained in:
Kaming Chan 2022-05-13 11:21:39 +08:00 committed by 世界
parent 695fb64fa8
commit c3f4e1ba2e
No known key found for this signature in database
GPG Key ID: CD109927C34A63C4
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
transport/ssr/protocol/auth_aes128_sha1.go
View File

@ -154,6 +154,9 @@ func (a *authAES128) Encode(buf *bytes.Buffer, b []byte) error {
} }
func (a *authAES128) DecodePacket(b []byte) ([]byte, error) { func (a *authAES128) DecodePacket(b []byte) ([]byte, error) {
if len(b) < 4 {
return nil, errAuthAES128LengthError
}
if !bytes.Equal(a.hmac(a.Key, b[:len(b)-4])[:4], b[len(b)-4:]) { if !bytes.Equal(a.hmac(a.Key, b[:len(b)-4])[:4], b[len(b)-4:]) {
return nil, errAuthAES128ChksumError return nil, errAuthAES128ChksumError
} }