title: iOS AES Encryption with Vulnerability: Signed Memory Arithmetic
body: <p>I'm using AES encryption to encrypt / decrypt user's info in my app.<br>
  This is the code I'm using:<br>
  <a href="https://gist.github.com/matsuda/9204276" rel="nofollow">https://gist.github.com/matsuda/9204276</a><br>
  Everything works just fine.<br>
  But the code got scanned for security vulnerability recently and there's an issue that got flagged.<br></p>
  
  <p>The vulnerability: <br>
  Signed Memory Arithmetic<br>
  Description: <br>
      The software reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.<br>
  <br>
  Line 39-40 of <code>NSData+AES.m</code> of the code in the above link is where it got highlighted<br>
      <code>size_t bufferSize = dataLength + kCCBlockSizeAES128;</code><br>
      <code>void *buffer = malloc(bufferSize);</code></p>
  
  <p>I'm not sure what I should do.<br>
  The buffer size is calculated with dataLength + kCCBlockSizeAES128 just before allocation so the length should be okay?<br>
  <br>
  Thanks for your help in advance.</p>