This is an automated email from the ASF dual-hosted git repository.
boroknagyz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/impala.git
The following commit(s) were added to refs/heads/master by this push:
new a146d91aa IMPALA-14666: Fix invalid input handling for aes_decrypt
a146d91aa is described below
commit a146d91aa7b5ef9e32c59b453e985333721bf799
Author: Peter Rozsa <[email protected]>
AuthorDate: Thu Jan 8 15:32:31 2026 +0100
IMPALA-14666: Fix invalid input handling for aes_decrypt
aes_decrypt with AES_128_GCM and AES_256_GCM modes subtracts the AES
block size from the length of the input that causes negative numbers
if the input text is shorter than the block size. This change adds a
check for GCM mode and reports an error if the input is shorter than
the block size.
Tests:
- new test cases added to encryption_exprs_errors.test
Change-Id: I8e23c2682b851082479a52d754b74f35fe0734c7
Reviewed-on: http://gerrit.cloudera.org:8080/23839
Reviewed-by: Impala Public Jenkins <[email protected]>
Tested-by: Impala Public Jenkins <[email protected]>
---
be/src/exprs/string-functions.cc | 4 ++++
.../queries/QueryTest/encryption_exprs_errors.test | 12 ++++++++++++
2 files changed, 16 insertions(+)
diff --git a/be/src/exprs/string-functions.cc b/be/src/exprs/string-functions.cc
index 1d9999911..51e18f345 100644
--- a/be/src/exprs/string-functions.cc
+++ b/be/src/exprs/string-functions.cc
@@ -518,6 +518,10 @@ StringVal StringFunctions::AesDecryptImpl(FunctionContext*
ctx, const StringVal&
// Remove spaces and set value of gcm_tag in case of GCM mode
if (encryption_key.IsGcmMode()) {
+ if (len < AES_BLOCK_SIZE) {
+ ctx->SetError("AES GCM input too short to contain a tag");
+ return StringVal::null();
+ }
len -= AES_BLOCK_SIZE;
encryption_key.SetGcmTag(expr.ptr + len);
}
diff --git
a/testdata/workloads/functional-query/queries/QueryTest/encryption_exprs_errors.test
b/testdata/workloads/functional-query/queries/QueryTest/encryption_exprs_errors.test
index 869b120fd..74d1c0817 100644
---
a/testdata/workloads/functional-query/queries/QueryTest/encryption_exprs_errors.test
+++
b/testdata/workloads/functional-query/queries/QueryTest/encryption_exprs_errors.test
@@ -53,3 +53,15 @@ select
aes_decrypt(base64decode('F/DLkSwEikFOlqzXVCysy1JX7Q=='),'123456789012345
---- CATCH
UDF ERROR: Invalid AES 'mode': AES_256_GC
====
+---- QUERY
+select aes_decrypt("a",'1234567890123456','AES_128_GCM','1234567890123456');
+---- RESULTS
+---- CATCH
+UDF ERROR: AES GCM input too short to contain a tag
+====
+---- QUERY
+select
aes_decrypt("a",'12345678901234567890123456789012','AES_256_GCM','1234567890123456');
+---- RESULTS
+---- CATCH
+UDF ERROR: AES GCM input too short to contain a tag
+====
