Prevent CWE-190/AllocationSizeOverflow in KDF (#13237)
Prevent CWE-190/AllocationSizeOverflow in KDF (#13237)

In the Counter-mode KBKDF implementation, due to the nature of the PRF
(being implemented as a function rather than a hash.Hash instance), we
need to allocate a buffer capable of storing the entire input to the
PRF. This consists of the user-supplied context with 8 additional bytes
(4 before and 4 after) of encoded integers.

If the user supplies a maximally-sized context, the internally allocated
buffer's size computation will overflow, resulting in a runtime panic.
Guard against this condition.

Signed-off-by: Alexander Scheel <bfa222ba5bf8b529a89ed3140dfb6b6aaf42dd20@hashicorp.com>
hashicorp/vault,rnaveiras/vault,hashicorp/vault,rnaveiras/vault,rnaveiras/vault,hashicorp/vault,hashicorp/vault,rnaveiras/vault,hashicorp/vault,rnaveiras/vault,hashicorp/vault