Grain-128AEAD: report an output buffer too short for a processBytes() or processByte() call as an OutputLengthException, as the general AEAD path does, rather than letting the write run off the end.

Author: dghgit

core/src/main/java/org/bouncycastle/crypto/engines/AEADBaseEngine.java

@@ -711,6 +711,7 @@ public int processByte(byte input, byte[] output, int outOff)
             boolean forEncryption = checkData(false);
             if (forEncryption)
             {
+                ensureSufficientOutputBuffer(output, outOff, 1);
                 this.len = 1;
                 singleByte[0] = input;
                 processBufferEncrypt(singleByte, 0, output, outOff);
@@ -720,6 +721,7 @@ public int processByte(byte input, byte[] output, int outOff)
             {
                 if (m_bufPos == MAC_SIZE)
                 {
+                    ensureSufficientOutputBuffer(output, outOff, 1);
                     this.len = 1;
                     processBufferDecrypt(m_buf, 0, output, outOff);
                     System.arraycopy(m_buf, 1, m_buf, 0, m_bufPos - 1);
@@ -746,6 +748,10 @@ public int processBytes(byte[] input, int inOff, int len, byte[] output, int out
             boolean forEncryption = checkData(false);
             if (forEncryption)
             {
+                if (len > 0)
+                {
+                    ensureSufficientOutputBuffer(output, outOff, len);
+                }
                 this.len = len;
                 processBufferEncrypt(input, inOff, output, outOff);
                 return len;
@@ -754,6 +760,11 @@ public int processBytes(byte[] input, int inOff, int len, byte[] output, int out
             {
                 // keep last mac size bytes
                 int available = Math.max(m_bufPos + len - MAC_SIZE, 0);
+                // checked before anything is written or buffered, and only when there is output
+                if (available > 0)
+                {
+                    ensureSufficientOutputBuffer(output, outOff, available);
+                }
                 int rlt = 0;
                 if (m_bufPos > 0)
                 {

core/src/test/java/org/bouncycastle/crypto/test/Grain128AEADTest.java

@@ -3,6 +3,7 @@
 import java.security.SecureRandom;
 
 import org.bouncycastle.crypto.InvalidCipherTextException;
+import org.bouncycastle.crypto.OutputLengthException;
 import org.bouncycastle.crypto.engines.Grain128AEADEngine;
 import org.bouncycastle.crypto.modes.AEADCipher;
 import org.bouncycastle.crypto.params.KeyParameter;
@@ -233,6 +234,56 @@ private void testExceptions()
         {
             isEquals("Grain-128 AEAD key must be 16 bytes long", e.getMessage());
         }
+
+        ParametersWithIV params = new ParametersWithIV(new KeyParameter(new byte[16]), new byte[12]);
+        byte[] pt = new byte[64];
+
+        Grain128AEADEngine grain = new Grain128AEADEngine();
+
+        grain.init(true, params);
+
+        byte[] ct = new byte[grain.getOutputSize(pt.length)];
+        int ctLen = grain.processBytes(pt, 0, pt.length, ct, 0);
+        ctLen += grain.doFinal(ct, ctLen);
+
+        // an output buffer too short for what the call would write is reported the way the other
+        // AEAD engines report it, rather than as an ArrayIndexOutOfBoundsException
+        try
+        {
+            grain.init(true, params);
+            grain.processBytes(pt, 0, pt.length, new byte[pt.length - 1], 0);
+            fail("no exception");
+        }
+        catch (OutputLengthException e)
+        {
+            isEquals("output buffer too short", e.getMessage());
+        }
+
+        try
+        {
+            grain.init(false, params);
+            grain.processBytes(ct, 0, ctLen, new byte[pt.length - 1], 0);
+            fail("no exception");
+        }
+        catch (OutputLengthException e)
+        {
+            isEquals("output buffer too short", e.getMessage());
+        }
+
+        try
+        {
+            grain.init(true, params);
+            grain.processByte((byte)1, new byte[0], 0);
+            fail("no exception");
+        }
+        catch (OutputLengthException e)
+        {
+            isEquals("output buffer too short", e.getMessage());
+        }
+
+        // nothing is released while the tag is still buffered, so the output is not touched
+        grain.init(false, params);
+        isEquals("buffered decryption releases nothing", 0, grain.processBytes(ct, 0, 8, new byte[0], 0));
     }
 
     static void checkAEADCipherOutputSize(SimpleTest parent, int keySize, int ivSize, int tagSize, AEADCipher cipher)

docs/releasenotes.md

@@ -28,6 +28,7 @@ Date: 2026, TBD
 - An ERSDataGroup recomputed its hash on every request rather than taking it from the cache ERSCachingData exists to provide: the group overrode getHash(), which left the calculateHash() the cache calls unreachable - and wrong, as it copied the member hashes with a loop bounded by the size of the empty list it was copying into, so it would have digested nothing had anything reached it. The computation is back in calculateHash() and the override is gone, so a group's hash is computed once per digest algorithm and previous-chain hash, as every other ERSData's is. The value itself is unchanged.
 - ERSArchiveTimeStampGenerator rebuilt its reduced hash tree from the data objects on every call, so the usual generateTimeStampRequest() followed by generateArchiveTimeStamp() or generateArchiveTimeStamps() built it twice. The leaves are now built once and dropped when data or a previous chain is added. A Set of the data groups it had been given, which nothing ever read, has gone with it.
 - Grain-128AEAD returned corrupted plaintext from a decryption driven in chunks. The stream cipher data operator splits a processBytes() call that spans the buffered authentication tag into two output segments, the bytes released from the tag buffer and then the bytes taken straight from the caller's input, and wrote the second segment at the caller's output offset instead of after the first, so the second segment overwrote the head of the first and the tail of the reported output was never written at all. The call still returned the full byte count, and because the engine's state update depends on the input and the keystream rather than on where the output lands, the tag still verified: the wrong plaintext came back with no error raised. Any chunk after the first that carried more than the 8 byte tag length was affected. Grain-128AEAD is the only engine that uses this operator, and one shot decryption, the encryption path and every other AEAD engine were unaffected. The second segment is now written at the advanced offset, matching the equivalent step of the general decryption path (github PR #2447).
+- The AEAD stream cipher data operator, which Grain-128AEAD alone uses, wrote its output without first checking that the caller's buffer was long enough, so a short output buffer surfaced as an ArrayIndexOutOfBoundsException from inside the engine rather than as the OutputLengthException the general path reports for every other AEAD engine. Both directions of processBytes(), and processByte(), now check before anything is written or buffered, and only when the call releases output, as the general path does.
 
 ### 2.1.3 Additional Features and Functionality