bodgit / sevenzip / 37239233519

77%

push

github

fix(aes7z): don't corrupt coder properties when deriving key (#492)

The salt passed to calculateKey is a subslice of the AES coder
properties, so wrapping it with bytes.NewBuffer and appending the
UTF-16LE password wrote through the aliased backing array whenever it
had spare capacity, overwriting the IV that follows the salt. Any
later reader created from the same folder then used a corrupted IV,
garbling the first block and failing the CRC check despite the correct
password. The key cache often masked this, as only a cache miss writes.

Copy the salt before appending the password.

Fixes #489

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1 of 1 new or added line in 1 file covered. (100.0%)

1872 of 2484 relevant lines covered (75.36%)

0.85 hits per line