terl / lazysodium-java

A Java implementation of the Libsodium crypto library. For the lazy dev.

Home Page:https://github.com/terl/lazysodium-java/wiki

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

sodiumHex2Bin silently accepts garbage input

timmc opened this issue · comments

The implementation hexToBytes accepts non-hex characters and does math on their values as if they are hex chars. For example,ABCD__ and ABCDEF turn into the same bytes. (Character.digit uses a return value of -1 as an error code.)

(EDIT: I had previously thought it didn't fail for an odd number of characters, but it actually does. However, an explicit check would be safer.)