CVE-2021-3711: SM2 Plaintext Size Miscalculation Leading to Heap Overflow

Replace the sm2_plaintext_size() function's overhead calculation approach with proper ASN.1 ciphertext structure decoding. Instead of trying to estimate the overhead: (1) Accept the actual ciphertext and ciphertext length as parameters; (2) Use d2i_SM2_Ciphertext() to properly parse the ASN.1 structure; (3) Return the length of the C2 component (sm2_ctext->C2->length) as the plaintext size, which is definitionally correct; (4) Update all callers to pass ciphertext instead of msg_len. This eliminates the entire class of offset calculation errors by inspecting the actual structure rather than estimating it.", "verification_notes": "The vulnerability is confirmed by OpenSSL commit 36cf45ef3b (Correctly calculate the length of SM2 plaintext given the ciphertext) authored by Matt Caswell and dated 2021-08-13. The commit message explicitly states 'If the calculated overhead is incorrect and larger than the actual value this can result in the calculated plaintext length being too small. Applications are likely to allocate buffer sizes based on this and therefore a buffer overrun can occur.' The fixed version changed the function signature and implementation to use proper ASN.1 decoding.", "bug_class": "heap-overflow", "error_type": "HeapBufferOverflow", "error_category": "data", "lang": "c", "lib_versions": { "openssl": "1.1.1k" }, "tags": [ "SM2", "ASN.1", "buffer-overflow", "cryptography", "CVE-2021-3711" ], "artifacts": [ { "kind": "code-excerpt", "content": "int sm2_plaintext_size(const EC_KEY *key, const EVP_MD *digest, size_t msg_len,\n size_t *pt_size)\n{\n const size_t field_size = ec_field_size(EC_KEY_get0_group(key));\n const int md_size = EVP_MD_size(digest);\n size_t overhead;\n\n if (md_size < 0) {\n SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_DIGEST);\n return 0;\n }\n if (field_size == 0) {\n SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_FIELD);\n return 0;\n }\n\n overhead = 10 + 2 * field_size + (size_t)md_size; // WRONG: Assumes fixed C1x/C1y size\n if (msg_len <= overhead) {\n SM2err(SM2_F_SM2_PLAINTEXT_SIZE, SM2_R_INVALID_ENCODING);\n return 0;\n }\n\n *pt_size = msg_len - overhead; // Can underestimate if actual overhead is smaller\n return 1;\n}", "role": "manifests", "source_path": "crypto/sm2/sm2_crypt.c", "source_lines": [64, 88], "language": "c" }, { "kind": "code-excerpt", "content": "int sm2_decrypt(const EC_KEY *key,\n const EVP_MD *digest,\n const uint8_t *ciphertext,\n size_t ciphertext_len, uint8_t *ptext_buf, size_t *ptext_len)\n{\n // ... parsing code ...\n msg_len = sm2_ctext->C2->length; // Extract plaintext length from ciphertext\n \n // ... buffer allocations ...\n msg_mask = OPENSSL_zalloc(msg_len);\n \n // ... decryption ...\n for (i = 0; i != msg_len; ++i)\n ptext_buf[i] = C2[i] ^ msg_mask[i]; // OVERFLOW: if msg_len > *ptext_len\n \n // ...\n *ptext_len = msg_len; // Output length\n}", "role": "manifests", "source_path": "crypto/sm2/sm2_crypt.c", "source_lines": [263, 356], "language": "c" } ] }