Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows.

bin2hex, encrypt, aes256gcmencryptafternm and seal functions do not check that output size will be less than SIZEMAX, which could lead to integer wraparound causing an undersized output buffer.

Encountering this issue is unlikely as the message length would need to be very large.

For bin2hex() the binlen would have to be > SIZEMAX / 2 For encrypt() the msglen would need to be > SIZEMAX - 16U For aes256gcmencryptafternm() the msglen would need to be > SIZEMAX - 16U For seal() the enclen would need to be > SIZEMAX - 64U

Crypt::NaCl::Sodium versions through 2.001 for Perl has an integer overflow flaw on 32-bit systems.

Sodium.xs casts a STRLEN (sizet) to unsigned long long when passing a length pointer to libsodium functions. On 32-bit systems sizet is typically 32-bits while an unsigned long long is at least 64-bits.