Check IV and CEK sizes correspond to the algorithms requirements

Author: Spomky

src/Component/Encryption/JWEDecrypter.php

@@ -125,6 +125,8 @@ private function decryptRecipientKey(JWE $jwe, JWKSet $jwkset, int $i): ?string
         $key_encryption_algorithm = $this->getKeyEncryptionAlgorithm($completeHeader);
         $content_encryption_algorithm = $this->getContentEncryptionAlgorithm($completeHeader);
 
+        $this->checkIvSize($jwe->getIV(), $content_encryption_algorithm->getIVSize());
+
         foreach ($jwkset as $jwk) {
             try {
                 KeyChecker::checkKeyUsage($jwk, 'decryption');
@@ -135,6 +137,8 @@ private function decryptRecipientKey(JWE $jwe, JWKSet $jwkset, int $i): ?string
                 }
                 $cek = $this->decryptCEK($key_encryption_algorithm, $content_encryption_algorithm, $jwk, $recipient, $completeHeader);
                 if (null !== $cek) {
+                    $this->checkCekSize($cek, $key_encryption_algorithm, $content_encryption_algorithm);
+
                     return $this->decryptPayload($jwe, $cek, $content_encryption_algorithm, $completeHeader);
                 }
             } catch (\Exception $e) {
@@ -146,6 +150,27 @@ private function decryptRecipientKey(JWE $jwe, JWKSet $jwkset, int $i): ?string
         return null;
     }
 
+    private function checkCekSize(string $cek, KeyEncryptionAlgorithm $keyEncryptionAlgorithm, ContentEncryptionAlgorithm $algorithm): void
+    {
+        if ($keyEncryptionAlgorithm instanceof DirectEncryption || $keyEncryptionAlgorithm instanceof KeyAgreement) {
+            return;
+        }
+        if (mb_strlen($cek, '8bit') !== $algorithm->getCEKSize() / 8) {
+            var_dump(mb_strlen($cek, '8bit'), $algorithm->getCEKSize() / 8);
+            throw new \InvalidArgumentException('Invalid CEK size');
+        }
+    }
+
+    private function checkIvSize(?string $iv, int $requiredIvSize): void
+    {
+        if (null === $iv && 0 !== $requiredIvSize) {
+            throw new \InvalidArgumentException('Invalid IV size');
+        }
+        if (\is_string($iv) && mb_strlen($iv, '8bit') !== $requiredIvSize / 8) {
+            throw new \InvalidArgumentException('Invalid IV size');
+        }
+    }
+
     private function checkRecipients(JWE $jwe)
     {
         if (0 === $jwe->countRecipients()) {