Validate HPKE sender buffer overlaps

Reject input/output and output/output overlap before sender core operations while permitting read-only input aliasing. Document overlapping-buffer exceptions and cover rejection before mutation and adjacent buffer handling.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 438fb068-aa8f-4969-9e8c-7065b52b74b5

src/libraries/Common/src/System/Security/Cryptography/Hpke.cs

@@ -483,6 +483,45 @@ public void Seal(
             ciphertext = ciphertextBuffer;
         }
 
+        /// <summary>
+        ///   Encrypts and authenticates a single message into the provided buffers using Base mode.
+        /// </summary>
+        /// <param name="plaintext">
+        ///   The message to encrypt.
+        /// </param>
+        /// <param name="encapsulatedSecret">
+        ///   The buffer to receive the encapsulated secret to send to the recipient.
+        /// </param>
+        /// <param name="ciphertext">
+        ///   The buffer to receive the ciphertext followed by its authentication tag.
+        /// </param>
+        /// <param name="associatedData">
+        ///   The additional data to authenticate without encrypting.
+        /// </param>
+        /// <param name="info">
+        ///   The application context, which must match the value used by the recipient.
+        /// </param>
+        /// <exception cref="ArgumentException">
+        ///   <paramref name="encapsulatedSecret" /> is not exactly <see cref="HpkeSuite.EncapsulatedSecretSizeInBytes" />
+        ///   bytes long, <paramref name="ciphertext" /> is not exactly the length returned by
+        ///   <see cref="HpkeSuite.GetCiphertextLength" /> for <paramref name="plaintext" />,
+        ///   or <paramref name="info" /> exceeds the cipher suite's KDF length limit.
+        /// </exception>
+        /// <exception cref="ArgumentOutOfRangeException">
+        ///   The ciphertext length would exceed <see cref="int.MaxValue" />.
+        /// </exception>
+        /// <exception cref="CryptographicException">
+        ///   <para>
+        ///     One or more provided buffers overlap.
+        ///   </para>
+        ///   <para> -or- </para>
+        ///   <para>
+        ///     The current instance does not contain an encapsulation key, or an error occurred during encryption.
+        ///   </para>
+        /// </exception>
+        /// <exception cref="ObjectDisposedException">
+        ///   The object has already been disposed.
+        /// </exception>
         public void Seal(
             ReadOnlySpan<byte> plaintext,
             Span<byte> encapsulatedSecret,
@@ -509,6 +548,17 @@ public void Seal(
                     nameof(ciphertext));
             }
 
+            if (encapsulatedSecret.Overlaps(ciphertext) ||
+                plaintext.Overlaps(encapsulatedSecret) ||
+                associatedData.Overlaps(encapsulatedSecret) ||
+                info.Overlaps(encapsulatedSecret) ||
+                plaintext.Overlaps(ciphertext) ||
+                associatedData.Overlaps(ciphertext) ||
+                info.Overlaps(ciphertext))
+            {
+                throw new CryptographicException(SR.Cryptography_OverlappingBuffers);
+            }
+
             SealCore(plaintext, encapsulatedSecret, ciphertext, associatedData, info);
         }
 
@@ -807,7 +857,13 @@ public HpkeSender CreateSender(out byte[] encapsulatedSecret, ReadOnlySpan<byte>
         ///   </para>
         /// </exception>
         /// <exception cref="CryptographicException">
-        ///   The current instance does not contain an encapsulation key, or an error occurred while creating the sender.
+        ///   <para>
+        ///     One or more provided buffers overlap.
+        ///   </para>
+        ///   <para> -or- </para>
+        ///   <para>
+        ///     The current instance does not contain an encapsulation key, or an error occurred while creating the sender.
+        ///   </para>
         /// </exception>
         /// <exception cref="PlatformNotSupportedException">
         ///   Creating a sender is not supported on the current platform.
@@ -827,6 +883,11 @@ public HpkeSender CreateSender(Span<byte> encapsulatedSecret, ReadOnlySpan<byte>
                     nameof(encapsulatedSecret));
             }
 
+            if (info.Overlaps(encapsulatedSecret))
+            {
+                throw new CryptographicException(SR.Cryptography_OverlappingBuffers);
+            }
+
             return CreateSenderCore(encapsulatedSecret, info);
         }
 
@@ -1096,7 +1157,13 @@ public HpkeSender CreatePskSender(
         ///   <see cref="HpkeSuite.EncapsulatedSecretSizeInBytes" /> bytes long.
         /// </exception>
         /// <exception cref="CryptographicException">
-        ///   The current instance does not contain an encapsulation key, or an error occurred while creating the sender.
+        ///   <para>
+        ///     One or more provided buffers overlap.
+        ///   </para>
+        ///   <para> -or- </para>
+        ///   <para>
+        ///     The current instance does not contain an encapsulation key, or an error occurred while creating the sender.
+        ///   </para>
         /// </exception>
         /// <exception cref="PlatformNotSupportedException">
         ///   Creating a PSK sender is not supported on the current platform.
@@ -1125,6 +1192,13 @@ public HpkeSender CreatePskSender(
                     nameof(encapsulatedSecret));
             }
 
+            if (psk.Overlaps(encapsulatedSecret) ||
+                pskId.Overlaps(encapsulatedSecret) ||
+                info.Overlaps(encapsulatedSecret))
+            {
+                throw new CryptographicException(SR.Cryptography_OverlappingBuffers);
+            }
+
             return CreatePskSenderCore(encapsulatedSecret, info, psk, pskId);
         }
 

src/libraries/Common/src/System/Security/Cryptography/HpkeSender.cs

@@ -120,7 +120,13 @@ public byte[] Seal(byte[] plaintext, byte[]? associatedData = null)
         ///   The ciphertext length would exceed <see cref="int.MaxValue" />.
         /// </exception>
         /// <exception cref="CryptographicException">
-        ///   The sender's message limit has been reached, or an error occurred during encryption.
+        ///   <para>
+        ///     One or more provided buffers overlap.
+        ///   </para>
+        ///   <para> -or- </para>
+        ///   <para>
+        ///     The sender's message limit has been reached, or an error occurred during encryption.
+        ///   </para>
         /// </exception>
         /// <exception cref="ObjectDisposedException">
         ///   The object has already been disposed.
@@ -140,6 +146,11 @@ public void Seal(
                     nameof(ciphertext));
             }
 
+            if (plaintext.Overlaps(ciphertext) || associatedData.Overlaps(ciphertext))
+            {
+                throw new CryptographicException(SR.Cryptography_OverlappingBuffers);
+            }
+
             SealCore(plaintext, ciphertext, associatedData);
         }
 

src/libraries/System.Security.Cryptography/tests/HpkeTests.cs

@@ -1731,9 +1731,180 @@ public static void Context_Export(HpkeKem kem, HpkeKdf kdf, HpkeAead aead)
             }
         }
 
+        [Theory]
+        [InlineData(-1)]
+        [InlineData(0)]
+        [InlineData(1)]
+        public static void Seal_RejectsOverlappingBuffers(int offset)
+        {
+            HpkeSuite suite = new(HpkeKem.DHKEM_P256_HKDF_SHA256, HpkeKdf.HKDF_SHA256, HpkeAead.AES_128_GCM);
+            // Indices: plaintext, associatedData, info, encapsulatedSecret, ciphertext.
+            (int First, int Second)[] pairs = [(0, 3), (1, 3), (2, 3), (0, 4), (1, 4), (2, 4), (3, 4)];
+
+            foreach ((int first, int second) in pairs)
+            {
+                byte[][] buffers = [new byte[128], new byte[128], new byte[128], new byte[128], new byte[128]];
+                buffers[second] = buffers[first];
+                buffers[first].AsSpan().Fill(0xA5);
+                byte[] original = (byte[])buffers[first].Clone();
+                int[] starts = [16, 16, 16, 16, 16];
+                starts[second] += offset;
+
+                using (RecordingHpke key = new(suite))
+                {
+                    Assert.Throws<CryptographicException>(() => key.Seal(
+                        buffers[0].AsSpan(starts[0], 32),
+                        buffers[3].AsSpan(starts[3], suite.EncapsulatedSecretSizeInBytes),
+                        buffers[4].AsSpan(starts[4], suite.GetCiphertextLength(32)),
+                        buffers[1].AsSpan(starts[1], 32),
+                        buffers[2].AsSpan(starts[2], 32)));
+                    Assert.Equal(0, key.SealCalls);
+                    Assert.Equal(original, buffers[first]);
+                }
+            }
+        }
+
+        [Theory]
+        [InlineData(-1)]
+        [InlineData(0)]
+        [InlineData(1)]
+        public static void CreateSender_RejectsOverlappingBuffers(int offset)
+        {
+            HpkeSuite suite = new(HpkeKem.DHKEM_P256_HKDF_SHA256, HpkeKdf.HKDF_SHA256, HpkeAead.AES_128_GCM);
+            byte[] buffer = new byte[128];
+            buffer.AsSpan().Fill(0xA5);
+            byte[] original = (byte[])buffer.Clone();
+
+            using (RecordingHpke key = new(suite))
+            {
+                Assert.Throws<CryptographicException>(() => key.CreateSender(
+                    buffer.AsSpan(16 + offset, suite.EncapsulatedSecretSizeInBytes),
+                    buffer.AsSpan(16, 32)));
+                Assert.Equal(0, key.CreateSenderCalls);
+                Assert.Equal(original, buffer);
+            }
+        }
+
+        [Theory]
+        [InlineData(-1)]
+        [InlineData(0)]
+        [InlineData(1)]
+        public static void CreatePskSender_RejectsOverlappingBuffers(int offset)
+        {
+            HpkeSuite suite = new(HpkeKem.DHKEM_P256_HKDF_SHA256, HpkeKdf.HKDF_SHA256, HpkeAead.AES_128_GCM);
+
+            for (int input = 0; input < 3; input++)
+            {
+                byte[][] inputs = [new byte[128], new byte[128], new byte[128]];
+                byte[] output = inputs[input];
+                output.AsSpan().Fill(0xA5);
+                byte[] original = (byte[])output.Clone();
+
+                using (RecordingHpke key = new(suite))
+                {
+                    Assert.Throws<CryptographicException>(() => key.CreatePskSender(
+                        inputs[0].AsSpan(16, 32),
+                        inputs[1].AsSpan(16, 32),
+                        output.AsSpan(16 + offset, suite.EncapsulatedSecretSizeInBytes),
+                        inputs[2].AsSpan(16, 32)));
+                    Assert.Equal(0, key.PskCalls);
+                    Assert.Equal(0, key.CreateSenderCalls);
+                    Assert.Equal(original, output);
+                }
+            }
+        }
+
+        [Theory]
+        [InlineData(-1)]
+        [InlineData(0)]
+        [InlineData(1)]
+        public static void Sender_SealRejectsOverlappingBuffers(int offset)
+        {
+            HpkeSuite suite = new(HpkeKem.DHKEM_P256_HKDF_SHA256, HpkeKdf.HKDF_SHA256, HpkeAead.AES_128_GCM);
+
+            for (int input = 0; input < 2; input++)
+            {
+                byte[][] inputs = [new byte[128], new byte[128]];
+                byte[] output = inputs[input];
+                output.AsSpan().Fill(0xA5);
+                byte[] original = (byte[])output.Clone();
+
+                using (RecordingHpkeSender sender = new(suite))
+                {
+                    Assert.Throws<CryptographicException>(() => sender.Seal(
+                        inputs[0].AsSpan(16, 32),
+                        output.AsSpan(16 + offset, suite.GetCiphertextLength(32)),
+                        inputs[1].AsSpan(16, 32)));
+                    Assert.Equal(0, sender.SealCalls);
+                    Assert.Equal(original, output);
+                }
+            }
+        }
+
+        [Theory]
+        [InlineData(0)]
+        [InlineData(32)]
+        public static void Seal_AllowsReadOnlyOverlapAndAdjacentOutputs(int inputLength)
+        {
+            HpkeSuite suite = new(HpkeKem.DHKEM_P256_HKDF_SHA256, HpkeKdf.HKDF_SHA256, HpkeAead.AES_128_GCM);
+            int encLength = suite.EncapsulatedSecretSizeInBytes;
+            int ciphertextLength = suite.GetCiphertextLength(inputLength);
+            byte[] buffer = new byte[inputLength + encLength + ciphertextLength];
+            buffer.AsSpan().Fill(0xA5);
+            byte[] originalInput = buffer.AsSpan(0, inputLength).ToArray();
+
+            using (RecordingHpke key = new(suite))
+            {
+                key.Seal(
+                    buffer.AsSpan(0, inputLength),
+                    buffer.AsSpan(inputLength, encLength),
+                    buffer.AsSpan(inputLength + encLength, ciphertextLength),
+                    buffer.AsSpan(0, inputLength),
+                    buffer.AsSpan(0, inputLength));
+                Assert.Equal(1, key.SealCalls);
+                AssertExtensions.SequenceEqual(originalInput.AsSpan(), buffer.AsSpan(0, inputLength));
+                Assert.Equal(0xD7, buffer[inputLength]);
+                Assert.Equal(0xC8, buffer[^1]);
+            }
+
+            using (RecordingHpkeSender sender = new(suite))
+            {
+                sender.Seal(
+                    buffer.AsSpan(0, inputLength),
+                    buffer.AsSpan(inputLength, ciphertextLength),
+                    buffer.AsSpan(0, inputLength));
+                Assert.Equal(1, sender.SealCalls);
+                AssertExtensions.SequenceEqual(originalInput.AsSpan(), buffer.AsSpan(0, inputLength));
+            }
+        }
+
+        [Fact]
+        public static void CreateSender_AllowsReadOnlyOverlapAndAdjacentOutput()
+        {
+            HpkeSuite suite = new(HpkeKem.DHKEM_P256_HKDF_SHA256, HpkeKdf.HKDF_SHA256, HpkeAead.AES_128_GCM);
+            byte[] buffer = new byte[32 + suite.EncapsulatedSecretSizeInBytes];
+            buffer.AsSpan().Fill(0xA5);
+            byte[] originalInput = buffer.AsSpan(0, 32).ToArray();
+
+            using (RecordingHpke key = new(suite))
+            using (HpkeSender sender = key.CreateSender(buffer.AsSpan(32), buffer.AsSpan(0, 32)))
+            using (HpkeSender pskSender = key.CreatePskSender(
+                buffer.AsSpan(0, 32), buffer.AsSpan(0, 32), buffer.AsSpan(32), buffer.AsSpan(0, 32)))
+            {
+                Assert.Equal(2, key.CreateSenderCalls);
+                Assert.Equal(1, key.PskCalls);
+                Assert.Equal(originalInput, key.LastPsk);
+                Assert.Equal(originalInput, key.LastPskId);
+                Assert.Equal(originalInput, key.LastSenderInfo);
+                AssertExtensions.SequenceEqual(originalInput.AsSpan(), buffer.AsSpan(0, 32));
+                Assert.Equal(0xD7, buffer[^1]);
+            }
+        }
+
         private sealed class RecordingHpke : Hpke
         {
             internal bool OpenCoreCalled { get; private set; }
+            internal int SealCalls { get; private set; }
             internal int CreateSenderCalls { get; private set; }
             internal byte[] LastSenderInfo { get; private set; } = [];
             internal bool ThrowOnCreateSender { get; set; }
@@ -1821,8 +1992,12 @@ protected override void SealCore(
                 Span<byte> encapsulatedSecret,
                 Span<byte> ciphertext,
                 ReadOnlySpan<byte> associatedData,
-                ReadOnlySpan<byte> info) =>
-                throw new InvalidOperationException("Unexpected encryption.");
+                ReadOnlySpan<byte> info)
+            {
+                SealCalls++;
+                encapsulatedSecret.Fill(0xD7);
+                ciphertext.Fill(0xC8);
+            }
         }
 
         [Theory]