util: fix deserialize buffer overflow #74
Conversation
selvanair
left a comment
selvanair
left a comment
There was a problem hiding this comment.
Here is a simpler version which I hope is correct :)
https://gist.github.com/selvanair/e541faacac36a40f1066b091e87084de
lib/pkcs11h-util.c
Outdated
| else { | ||
| if (t != NULL) { | ||
| if (n+1 > *max) { | ||
| s++; |
There was a problem hiding this comment.
If t == NULL, this can advance past the end of s.
lib/pkcs11h-util.c
Outdated
| s++; | ||
|
|
||
| if (t != NULL && n < m) { | ||
| if (b2 = _ctoi(*s) == -1) { |
There was a problem hiding this comment.
should be ((b2 = _ctoi(*s)) == -1)
There was a problem hiding this comment.
yeah!!! thank you for finding it.
lib/pkcs11h-util.c
Outdated
| t++; | ||
| } | ||
| n++; | ||
| s++; |
There was a problem hiding this comment.
This can advance past the end if t is NULL or n >= m.
There was a problem hiding this comment.
thank you for reviewing... bummer I wanted to avoid logic when t == NULL...
Missing check for source file increment. Reported-by: Aarnav Bos <[email protected]>
|
@selvanair thank you so much for the review, I've modified the implementation to use macros, I hope now all is ok. |
|
Looks good to me if returning a wrong value of |
|
@selvanair @alonbl the fix also looks good from the fuzzing side! |
|
Thank you all! |
3 participants
Missing check for source file increment.
Reported-by: Aarnav Bos [email protected]