commit 7bf268c5368f5bb50b4d208a61dee8ed628713ed
author Tom Sepez <tsepez@chromium.org> Thu Nov 17 21:05:54 2022 +0000
committer Pdfium LUCI CQ <pdfium-scoped@luci-project-accounts.iam.gserviceaccount.com> Thu Nov 17 21:05:54 2022 +0000
tree 5084130fc1085f0a189b0b9f1f8c36b80c60733a
parent fb5521ae8881eb13005625e945f2b56825857a86

Replace memcpy() with safer spancpy() in fx_crypt.cpp

Change-Id: I9d168fab4580bc1d7802fa4f4c0b52c65293198a
Reviewed-on: https://pdfium-review.googlesource.com/c/pdfium/+/101530
Commit-Queue: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Lei Zhang <thestig@chromium.org>

core/fdrm/fx_crypt.cpp

diff --git a/core/fdrm/fx_crypt.cpp b/core/fdrm/fx_crypt.cpp
index cf7ef58..c702f92 100644
--- a/core/fdrm/fx_crypt.cpp
+++ b/core/fdrm/fx_crypt.cpp
@@ -6,10 +6,10 @@
 
 #include "core/fdrm/fx_crypt.h"
 
-#include <string.h>
-
 #include <utility>
 
+#include "core/fxcrt/span_util.h"
+
 #define GET_UINT32(n, b, i)                            \
   {                                                    \
     (n) = (uint32_t)((uint8_t*)b)[(i)] |               \
@@ -195,21 +195,20 @@
   context->total[1] += data.size() >> 29;
   context->total[0] &= 0xFFFFFFFF;
   context->total[1] += context->total[0] < data.size() << 3;
+
+  const pdfium::span<uint8_t> buffer_span = pdfium::make_span(context->buffer);
   if (left && data.size() >= fill) {
-    auto next_data = data.subspan(fill);
-    memcpy(context->buffer + left, data.data(), fill);
+    fxcrt::spancpy(buffer_span.subspan(left), data.first(fill));
     md5_process(context, context->buffer);
+    data = data.subspan(fill);
     left = 0;
-    data = next_data;
   }
   while (data.size() >= 64) {
-    auto next_data = data.subspan(64);
     md5_process(context, data.data());
-    data = next_data;
+    data = data.subspan(64);
   }
-  size_t remaining = data.size();
-  if (remaining)
-    memcpy(context->buffer + left, data.data(), remaining);
+  if (!data.empty())
+    fxcrt::spancpy(buffer_span.subspan(left), data);
 }
 
 void CRYPT_MD5Finish(CRYPT_md5_context* context, uint8_t digest[16]) {
@@ -218,7 +217,7 @@
   PUT_UINT32(context->total[1], msglen, 4);
   uint32_t last = (context->total[0] >> 3) & 0x3F;
   uint32_t padn = (last < 56) ? (56 - last) : (120 - last);
-  CRYPT_MD5Update(context, {md5_padding, padn});
+  CRYPT_MD5Update(context, pdfium::make_span(md5_padding).first(padn));
   CRYPT_MD5Update(context, msglen);
   PUT_UINT32(context->state[0], digest, 0);
   PUT_UINT32(context->state[1], digest, 4);