correct the minimum length of v00 messages from 50 (without the MAC) …

…to 82 (with the MAC) in
syseleven · Oct 30, 2019 · 15f3661 · 15f3661
1 parent a41c8a4
commit 15f3661
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 2 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,7 @@
+# 0.20b1 (2019-10-30)
+
+* correct the minimum length of v00 messages from 50 (without the MAC) to 82 (with the MAC) in `lib/shared-secrets.exec.php`
+
 # 0.20b0 (2019-10-29)
 
 * rewrote the application to use OpenSSL instead of GPG fixing indirect integrity vulnerabilities

diff --git a/index.php b/index.php
@@ -1,6 +1,6 @@
 <?php
 
-  # Shared-Secrets v0.20b0
+  # Shared-Secrets v0.20b1
   #
   # Copyright (c) 2016-2019, SysEleven GmbH
   # All rights reserved.

diff --git a/lib/shared-secrets.exec.php b/lib/shared-secrets.exec.php
@@ -96,7 +96,7 @@ function decrypt_v00($message, $password, &$error = null, &$checksum = null) {
         # check message format
         $data[OPENSSL_FULLMESSAGE] = $message;
 
-        if (50 <= strlen($data[OPENSSL_FULLMESSAGE])) {
+        if (82 <= strlen($data[OPENSSL_FULLMESSAGE])) {
           # parse message
           $data[OPENSSL_MACMESSAGE] = substr($data[OPENSSL_FULLMESSAGE],   0, -32);
           $data[OPENSSL_MAC]        = substr($data[OPENSSL_FULLMESSAGE], -32);