fix: invalid token cause crash

seal-io · Aug 15, 2023 · c3a01f1 · c3a01f1
1 parent 3953b76
commit c3a01f1
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/staging/utils/cryptox/encryptor_aesgcm.go b/staging/utils/cryptox/encryptor_aesgcm.go
@@ -4,6 +4,7 @@ import (
 	"crypto/aes"
 	"crypto/cipher"
 	"crypto/rand"
+	"fmt"
 	"io"
 )
 
@@ -50,6 +51,11 @@ func (e aesGcmEncryptor) Decrypt(c, a []byte) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
+
+	if len(c) < g.NonceSize() {
+		return nil, fmt.Errorf("too short")
+	}
+
 	n := c[:g.NonceSize()]
 	c = c[g.NonceSize():]