Fixup crypto key generation.

core/fpdfapi/fpdf_parser/cpdf_crypto_handler.cpp

 // Copyright 2014 PDFium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Original code copyright 2014 Foxit Software Inc. http://www.foxitsoftware.com
 
 #include "core/fpdfapi/fpdf_parser/cpdf_crypto_handler.h"
 
 #include <time.h>
 
 #include "core/fdrm/crypto/include/fx_crypt.h"
 #include "core/fpdfapi/fpdf_parser/cpdf_security_handler.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_parser.h"
 #include "core/fpdfapi/fpdf_parser/include/cpdf_simple_parser.h"
 
 void CPDF_CryptoHandler::CryptBlock(FX_BOOL bEncrypt,
                                     uint32_t objnum,
                                     uint32_t gennum,
                                     const uint8_t* src_buf,
                                     uint32_t src_size,
                                     uint8_t* dest_buf,
                                     uint32_t& dest_size) {
   if (m_Cipher == FXCIPHER_NONE) {
     FXSYS_memcpy(dest_buf, src_buf, src_size);
     return;
   }
   uint8_t realkey[16];
   int realkeylen = 16;
   if (m_Cipher != FXCIPHER_AES || m_KeyLen != 32) {
     uint8_t key1[32];

[Tom Sepez, 2016/07/28 20:46:22]

can we pull this into a helper function?

[dsinclair, 2016/07/28 20:55:23]

Done.

     FXSYS_memcpy(key1, m_EncryptKey, m_KeyLen);
     key1[m_KeyLen + 0] = (uint8_t)objnum;
     key1[m_KeyLen + 1] = (uint8_t)(objnum >> 8);
     key1[m_KeyLen + 2] = (uint8_t)(objnum >> 16);
     key1[m_KeyLen + 3] = (uint8_t)gennum;
     key1[m_KeyLen + 4] = (uint8_t)(gennum >> 8);
-    FXSYS_memcpy(key1 + m_KeyLen, &objnum, 3);
-    FXSYS_memcpy(key1 + m_KeyLen + 3, &gennum, 2);
     if (m_Cipher == FXCIPHER_AES) {
       FXSYS_memcpy(key1 + m_KeyLen + 5, "sAlT", 4);
     }
     CRYPT_MD5Generate(
         key1, m_Cipher == FXCIPHER_AES ? m_KeyLen + 9 : m_KeyLen + 5, realkey);
     realkeylen = m_KeyLen + 5;
     if (realkeylen > 16) {
       realkeylen = 16;
     }
   }
@@ skipping 52 matching lines @@
     if (bEncrypt) {
       for (int i = 0; i < 16; i++) {
         pContext->m_Block[i] = (uint8_t)rand();
       }
       CRYPT_AESSetIV(pContext->m_Context, pContext->m_Block);
     }
     return pContext;
   }
   uint8_t key1[48];
   FXSYS_memcpy(key1, m_EncryptKey, m_KeyLen);
-  FXSYS_memcpy(key1 + m_KeyLen, &objnum, 3);
-  FXSYS_memcpy(key1 + m_KeyLen + 3, &gennum, 2);
+  key1[m_KeyLen + 0] = (uint8_t)objnum;
+  key1[m_KeyLen + 1] = (uint8_t)(objnum >> 8);
+  key1[m_KeyLen + 2] = (uint8_t)(objnum >> 16);
+  key1[m_KeyLen + 3] = (uint8_t)gennum;
+  key1[m_KeyLen + 4] = (uint8_t)(gennum >> 8);
   if (m_Cipher == FXCIPHER_AES) {
     FXSYS_memcpy(key1 + m_KeyLen + 5, "sAlT", 4);
   }
   uint8_t realkey[16];
   CRYPT_MD5Generate(
       key1, m_Cipher == FXCIPHER_AES ? m_KeyLen + 9 : m_KeyLen + 5, realkey);
   int realkeylen = m_KeyLen + 5;
   if (realkeylen > 16) {
     realkeylen = 16;
   }
@@ skipping 205 matching lines @@
   return TRUE;
 }
 CPDF_CryptoHandler::CPDF_CryptoHandler() {
   m_pAESContext = nullptr;
   m_Cipher = FXCIPHER_NONE;
   m_KeyLen = 0;
 }
 CPDF_CryptoHandler::~CPDF_CryptoHandler() {
   FX_Free(m_pAESContext);
 }