Integer Overflow in Aspnet with Hmac Signatures

In ASP.NET applications, HMAC signatures are commonly used to ensure the integrity and authenticity of requests. When the length or count of elements included in the signature computation is derived from an integer value that is not properly validated, an integer overflow can occur. This can lead to incorrect signature calculations, buffer miscalculations, or unsafe memory operations when the resulting value is used to size buffers or allocate resources.

Consider a scenario where an ASP.NET endpoint accepts a JSON payload and computes an HMAC over a concatenated string that includes a numeric count field. If count is large (e.g., close to int.MaxValue), multiplying it by an element size to compute a total length may overflow before the value is used. For example:

int count = int.Parse(request.Form["count"]);
int elementSize = 256;
int totalSize = count * elementSize; // Risk of integer overflow
byte[] buffer = new byte[totalSize]; // Potentially undersized or negative

An attacker could supply a crafted count that causes the overflow to produce a very small totalSize, leading to a buffer overflow when the application copies data into the buffer. If the HMAC computation uses this buffer or length value, the resulting signature may be truncated or predictable, undermining the integrity check.

Additionally, if the application uses unchecked arithmetic (the default in C#), the overflow wraps around silently. This can cause the runtime to interpret a large expected payload as a tiny one, bypassing length checks that depend on the computed size. In the context of HMAC signatures, this may allow an attacker to forge a valid-looking signature by exploiting the mismatch between the intended and actual buffer sizes.

Such patterns are relevant to findings from security scanners that test input validation and property authorization across multiple security checks. The issue is not specific to a particular CVE with a published identifier in public databases at the time of writing, but it maps to common weaknesses in input validation and improper handling of numeric types as described in the OWASP API Top 10 and related frameworks.

To prevent integer overflow in ASP.NET when working with HMAC signatures, validate and sanitize all numeric inputs before using them in size or length calculations. Use checked arithmetic to detect overflows at runtime, and prefer types with larger ranges where appropriate. Below are concrete, working examples for secure HMAC handling.

1. Validate and bound input before computing size

Ensure numeric inputs are within a safe range before using them in multiplications or allocations:

const int MaxElements = 10_000;
const int ElementSize = 256;

if (!int.TryParse(request.Form["count"], out int count) || count < 0 || count > MaxElements)
{
    return Results.BadRequest("Invalid count.");
}

long totalSize = (long)count * ElementSize; // Use long to avoid overflow
if (totalSize > int.MaxValue)
{
    return Results.BadRequest("Requested size too large.");
}

byte[] buffer = new byte[totalSize];

2. Use checked arithmetic for critical calculations

Wrap computations in a checked block to throw an exception on overflow:

try
{
    checked
    {
        int totalSize = count * ElementSize;
        byte[] buffer = new byte[totalSize];
        // Use buffer in HMAC computation
    }
}
catch (OverflowException)
{
    return Results.StatusCode(StatusCodes.Status400BadRequest);
}

3. Compute HMAC safely with explicit buffers

When generating or verifying HMAC signatures, avoid deriving buffer sizes from unchecked inputs. Use explicit, bounded structures:

using System.Security.Cryptography;
using System.Text;

string data = request.Form["data"] ?? string.Empty;
string receivedSignature = request.Form["hmac"] ?? string.Empty;

// Use a fixed key; in production, store securely
byte[] key = Encoding.UTF8.GetBytes("your-256-bit-secret-key-32-bytes-long!!");

// Compute HMAC over known, bounded data
using var hmac = new HMACSHA256(key);
byte[] dataBytes = Encoding.UTF8.GetBytes(data);
byte[] hash = hmac.ComputeHash(dataBytes);
string computedSignature = Convert.ToBase64String(hash);

// Constant-time comparison to avoid timing attacks
bool isValid = CryptographicOperations.FixedTimeEquals(
    Convert.FromBase64String(receivedSignature),
    hash);

if (!isValid)
{
    return Results.Unauthorized();
}

These practices align with secure coding guidance and help ensure that HMAC-based integrity checks remain reliable. They also support compliance mapping to frameworks such as OWASP API Top 10 and SOC2 by demonstrating controlled input handling and verifiable signatures.