Avoid AEAD in-place slice aliasing (#21)

Author: thieman

src/aead.rs

@@ -6,16 +6,107 @@
 use rustls::crypto::cipher::NONCE_LEN;
 use rustls::Error;
 use windows::core::Owned;
+use windows::Win32::Foundation::NTSTATUS;
 use windows::Win32::Security::Cryptography::{
-    BCryptDecrypt, BCryptEncrypt, BCryptGenerateSymmetricKey, BCRYPT_AES_GCM_ALG_HANDLE,
-    BCRYPT_ALG_HANDLE, BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO,
-    BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO_VERSION, BCRYPT_CHACHA20_POLY1305_ALG_HANDLE,
-    BCRYPT_FLAGS, BCRYPT_KEY_HANDLE,
+    BCryptGenerateSymmetricKey, BCRYPT_AES_GCM_ALG_HANDLE, BCRYPT_ALG_HANDLE,
+    BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO, BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO_VERSION,
+    BCRYPT_CHACHA20_POLY1305_ALG_HANDLE, BCRYPT_FLAGS, BCRYPT_KEY_HANDLE,
 };
 
 /// The tag length is 16 bytes for all supported ciphers.
 pub(crate) const TAG_LEN: usize = 16;
 
+type BcryptInPlaceFn = unsafe fn(
+    BCRYPT_KEY_HANDLE,
+    *mut u8,
+    u32,
+    *mut BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO,
+    *mut u32,
+    BCRYPT_FLAGS,
+) -> NTSTATUS;
+
+const _: BcryptInPlaceFn = bcrypt_encrypt_in_place;
+const _: BcryptInPlaceFn = bcrypt_decrypt_in_place;
+
+#[link(name = "bcrypt")]
+extern "system" {
+    #[link_name = "BCryptEncrypt"]
+    fn bcrypt_encrypt_raw(
+        hkey: BCRYPT_KEY_HANDLE,
+        pbinput: *const u8,
+        cbinput: u32,
+        ppaddinginfo: *const core::ffi::c_void,
+        pbiv: *mut u8,
+        cbiv: u32,
+        pboutput: *mut u8,
+        cboutput: u32,
+        pcbresult: *mut u32,
+        dwflags: BCRYPT_FLAGS,
+    ) -> NTSTATUS;
+
+    #[link_name = "BCryptDecrypt"]
+    fn bcrypt_decrypt_raw(
+        hkey: BCRYPT_KEY_HANDLE,
+        pbinput: *const u8,
+        cbinput: u32,
+        ppaddinginfo: *const core::ffi::c_void,
+        pbiv: *mut u8,
+        cbiv: u32,
+        pboutput: *mut u8,
+        cboutput: u32,
+        pcbresult: *mut u32,
+        dwflags: BCRYPT_FLAGS,
+    ) -> NTSTATUS;
+}
+
+unsafe fn bcrypt_encrypt_in_place(
+    hkey: BCRYPT_KEY_HANDLE,
+    buffer: *mut u8,
+    len: u32,
+    info: *mut BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO,
+    pcbresult: *mut u32,
+    dwflags: BCRYPT_FLAGS,
+) -> NTSTATUS {
+    unsafe {
+        bcrypt_encrypt_raw(
+            hkey,
+            buffer as *const u8,
+            len,
+            info as *const core::ffi::c_void,
+            std::ptr::null_mut(),
+            0,
+            buffer,
+            len,
+            pcbresult,
+            dwflags,
+        )
+    }
+}
+
+unsafe fn bcrypt_decrypt_in_place(
+    hkey: BCRYPT_KEY_HANDLE,
+    buffer: *mut u8,
+    len: u32,
+    info: *mut BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO,
+    pcbresult: *mut u32,
+    dwflags: BCRYPT_FLAGS,
+) -> NTSTATUS {
+    unsafe {
+        bcrypt_decrypt_raw(
+            hkey,
+            buffer as *const u8,
+            len,
+            info as *const core::ffi::c_void,
+            std::ptr::null_mut(),
+            0,
+            buffer,
+            len,
+            pcbresult,
+            dwflags,
+        )
+    }
+}
+
 #[derive(Debug, Clone, Copy)]
 pub(crate) struct Algorithm {
     handle: BCRYPT_ALG_HANDLE,
@@ -101,7 +192,7 @@ impl AeadKey {
         let mut tag = [0u8; TAG_LEN];
 
         // https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/ns-bcrypt-bcrypt_authenticated_cipher_mode_info
-        let info = BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO {
+        let mut info = BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO {
             cbSize: core::mem::size_of::<BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO>() as u32,
             dwInfoVersion: BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO_VERSION,
             pbNonce: nonce.as_ptr().cast_mut(),
@@ -114,16 +205,16 @@ impl AeadKey {
         };
 
         unsafe {
-            // SAFETY: CNG supports in-place encryption, so the input and output buffers can be the same.
+            // SAFETY: CNG supports in-place encryption, and the raw helper accepts one buffer pointer
+            // so Rust does not materialize overlapping input and output slice references.
             let mut size = 0u32;
-            let input = std::slice::from_raw_parts(data.as_ptr().cast(), data.len());
+            let len = data.len().try_into().unwrap();
 
-            BCryptEncrypt(
+            bcrypt_encrypt_in_place(
                 *self.handle,
-                Some(input),
-                Some(std::ptr::from_ref(&info) as *mut _),
-                None,
-                Some(data),
+                data.as_mut_ptr(),
+                len,
+                std::ptr::from_mut(&mut info),
                 &mut size,
                 BCRYPT_FLAGS::default(),
             )
@@ -147,7 +238,7 @@ impl AeadKey {
         let (ciphertext, tag) = data.split_at_mut(payload_len - TAG_LEN);
 
         // https://learn.microsoft.com/en-us/windows/win32/api/bcrypt/ns-bcrypt-bcrypt_authenticated_cipher_mode_info
-        let info = BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO {
+        let mut info = BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO {
             cbSize: core::mem::size_of::<BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO>() as u32,
             dwInfoVersion: BCRYPT_AUTHENTICATED_CIPHER_MODE_INFO_VERSION,
             pbNonce: nonce.as_ptr().cast_mut(),
@@ -162,16 +253,15 @@ impl AeadKey {
         let mut size = 0u32;
 
         unsafe {
-            // SAFETY: CNG supports in-place decryption, so the input and output buffers can be the same.
-
-            let input = std::slice::from_raw_parts(ciphertext.as_ptr().cast(), ciphertext.len());
+            // SAFETY: CNG supports in-place decryption, and the raw helper accepts one buffer pointer
+            // so Rust does not materialize overlapping input and output slice references.
+            let len = ciphertext.len().try_into().unwrap();
 
-            BCryptDecrypt(
+            bcrypt_decrypt_in_place(
                 *self.handle,
-                Some(input),
-                Some(std::ptr::from_ref(&info) as *mut _),
-                None,
-                Some(ciphertext),
+                ciphertext.as_mut_ptr(),
+                len,
+                std::ptr::from_mut(&mut info),
                 &mut size,
                 BCRYPT_FLAGS::default(),
             )