fix: add bounds check before memcpy in crypto_lite.c

[orbisai0security]

Summary

Fix critical severity security issue in src/crypto_lite.c.

Vulnerability

Field	Value
ID	V-004
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-004
File	src/crypto_lite.c:90

Description: At src/crypto_lite.c:90, memcpy(block, data + i, rem) copies rem bytes from the input data buffer into block. If rem is derived from attacker-controlled stream data (e.g., the length field of an encrypted packet) without validation that rem <= sizeof(block) and that data+i does not exceed the source buffer, an out-of-bounds read from source or overflow into block occurs. At line 174, memcpy(rk, key, 16) unconditionally copies 16 bytes from key; if key is shorter than 16 bytes, an out-of-bounds read occurs. Both flaws are in the cryptographic processing hot path, directly reachable from network-delivered stream data.

Changes

• src/crypto_lite.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Improved SHA256 padding validation to correctly handle remaining bytes during edge cases in hash computation

• Refactor

  • Enhanced AES encryption key expansion with explicit parameter validation, zero-initialization of cryptographic buffers, and better support for varying key sizes while maintaining compatibility

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 02398662-33fb-4d51-ab6a-a344e6096aef

📥 Commits

Reviewing files that changed from the base of the PR and between 4178971 and 9b8d09a.

📒 Files selected for processing (1)

• src/crypto_lite.c

---

📝 Walkthrough

Walkthrough

This pull request tightens validation in two cryptographic primitives: SHA-256 padding adds a bounds check to prevent out-of-bounds access, and AES-128 key expansion is refactored to accept and validate key length explicitly, improving robustness of both hash and cipher functions.

Changes

Cryptographic Algorithm Improvements

Layer / File(s)	Summary
SHA-256 padding bounds check src/crypto_lite.c	SHA-256 padding path copy is guarded by a bounds check ensuring the remaining byte count is both greater than zero and less than the block size, preventing potential buffer overrun.
AES-128 key expansion refactoring src/crypto_lite.c	AES key expansion now accepts an explicit key_len parameter, zero-initializes the round-key buffer, and returns early with zeroed output if key_len < 16; otherwise it proceeds with the 16-byte copy and AES-128 key schedule. Both ECB encrypt and decrypt entry points are updated to pass the explicit key length argument when calling the refactored function.

🎯 2 (Simple) | ⏱️ ~8 minutes

🐰 A crypto rabbit hops through the code so fine,
Adding bounds that keep our padding in line,
And AES keys now take length with pride,
Validation flows firm on each encrypt side!
Security improved, no buffer surprise! 🔐

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the primary change: adding bounds checks before memcpy calls in crypto_lite.c to fix out-of-bounds vulnerabilities.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}