View Issue Details

IDProjectCategoryView StatusLast Update
0008103Talerexchangepublic2024-03-07 20:47
Reporterfefe Assigned ToChristian Grothoff  
PrioritynormalSeverityminorReproducibilityhave not tried
Status closedResolutionfixed 
Product Versiongit (master) 
Target Version0.9.4Fixed in Version0.9.4 
Summary0008103: parse_fees: integer truncation
DescriptionThis is in exchange/src/lib/exchange_api_handle.c:

 276 static struct TALER_EXCHANGE_WireFeesByMethod *
 277 parse_fees (const struct TALER_MasterPublicKeyP *master_pub,
 278 const char *currency,
 279 const json_t *fees,
 280 unsigned int *fees_len)

 283 unsigned int fbml = json_object_size (fees);

json_object_size returns a size_t, so fbml should be a size_t as well.

 293 unsigned int idx;

 298 json_array_foreach (fee_array, idx, fee)

243 #define json_array_foreach(array, index, value) \
244 for (index = 0; \
245 index < json_array_size(array) && (value = json_array_get(array, index)); \
246 index++)

json_array_size returns size_t, so idx should be size_t as well.

 284 unsigned int i = 0;

i is iterating through an array that can have size_t elements, so it should be size_t, too.

Lastly, the cleanup function, free_fees, should also be upgraded from unsigned int to size_t:

 245 static void
 246 free_fees (struct TALER_EXCHANGE_WireFeesByMethod *wfm,
 247 unsigned int wfm_len)
 248 {
 249 for (unsigned int i = 0; i<wfm_len; i++)

There is a consistency check at the end of parse_fees, but both sides fall victim to the same integer truncation, so it would not trigger:

 347 GNUNET_assert (i == fbml);
TagsNo tags attached.

Relationships

child of 0008112 assignedfefe Merchant security review 

Activities

Christian Grothoff

2024-01-18 22:38

manager   ~0020913

Changed type of fbml to size_t, plus adding

  if (UINT_MAX < fbml)
  {
    GNUNET_break (0);
    return NULL;
  }
ensures that the rest can remain of type "unsigned int". Done in c8126ffc..9e709172

Issue History

Date Modified Username Field Change
2024-01-18 14:23 fefe New Issue
2024-01-18 14:23 fefe Status new => assigned
2024-01-18 14:23 fefe Assigned To => Christian Grothoff
2024-01-18 22:38 Christian Grothoff Note Added: 0020913
2024-01-18 22:38 Christian Grothoff Status assigned => resolved
2024-01-18 22:38 Christian Grothoff Resolution open => fixed
2024-01-18 22:38 Christian Grothoff Fixed in Version => 0.9.4
2024-01-18 22:38 Christian Grothoff Product Version => git (master)
2024-01-18 22:38 Christian Grothoff Target Version => 0.9.4
2024-01-18 23:30 Christian Grothoff Relationship added child of 0008112
2024-03-07 20:47 Christian Grothoff Status resolved => closed