fix: AES key generation out of bounds #117

New Issue

MrUnknownDE · 2026-04-05T16:16:09+02:00

MrUnknownDE commented

2026-04-05 16:16:09 +02:00

Originally created by @wilk-polarny on 1/24/2026

AES key generation assumes that character amount = byte length, which is a dangerous assumption when working with multi-byte characters.
Using a password with multi-byte characters might trigger the padding logic, if the password has less than 32 characters but more than 32 bytes, thus leading to illegal Array accesses.
The proposed solution is to go off of the actual byte array, rather than the character sequence.

*Originally created by @wilk-polarny on 1/24/2026* AES key generation assumes that character amount = byte length, which is a dangerous assumption when working with multi-byte characters. Using a password with multi-byte characters might trigger the padding logic, if the password has less than 32 characters but more than 32 bytes, thus leading to illegal Array accesses. The proposed solution is to go off of the actual byte array, rather than the character sequence.

MrUnknownDE closed this issue

2026-04-05 16:16:09 +02:00

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/VRCX#117