What the developer wrote
Authored by Roman Zeyde
build(crypto): fix CI build error
[no changelog]
What changed, and why it matters
This commit changes two fixed text strings inside the ChaCha20 code from C string literals to explicit character arrays. The strings are public constants used by the ChaCha20 algorithm ('expand 32-byte k' and 'expand 16-byte k'). The commit title says it fixes a CI build error, and there is no evidence in the diff or commit message of any security bug, memory issue, or behavior change beyond how the compiler stores these constants.
No security action needed. Treat as a normal build-fix commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch replaces static const char sigma[16] = "expand 32-byte k"; and static const char tau[16] = "expand 16-byte k"; with equivalent brace-enclosed character arrays. Both forms define 16-byte constant arrays with the same contents. The change is semantically equivalent for the data used; it only affects compiler diagnostics/warnings (e.g., -Wunterminated-string-initialization or similar) that were breaking CI. No functional or security-relevant change is present in the diff.
Changed components
crypto/chacha20poly1305/chacha_merged.cInspect captured patch +2 / −2
diff --git a/crypto/chacha20poly1305/chacha_merged.c b/crypto/chacha20poly1305/chacha_merged.c
index f5c37fa8..0fa148a6 100644
--- a/crypto/chacha20poly1305/chacha_merged.c
+++ b/crypto/chacha20poly1305/chacha_merged.c
@@ -23,8 +23,8 @@ void ECRYPT_init(void)
return;
}
-static const char sigma[16] = "expand 32-byte k";
-static const char tau[16] = "expand 16-byte k";
+static const char sigma[] = {'e', 'x', 'p', 'a', 'n', 'd', ' ', '3', '2', '-', 'b', 'y', 't', 'e', ' ', 'k'};
+static const char tau[] = {'e', 'x', 'p', 'a', 'n', 'd', ' ', '1', '6', '-', 'b', 'y', 't', 'e', ' ', 'k'};
void ECRYPT_keysetup(ECRYPT_ctx *x,const u8 *k,u32 kbits,u32 ivbits)
{
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.