View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0006156GNUnetutil librarypublic2020-04-03 10:412020-07-09 07:17
Reporterfefe Assigned ToChristian Grothoff Due Date
PrioritynormalSeverityminorReproducibilityN/A
Status closedResolutionfixed 
Product VersionGit master 
Target Version0.13.0Fixed in Version0.13.0 
Summary0006156: Integer overflow in GNUNET_STRINGS_data_to_string
Description 875 if (out_size < (size * 8 + 4) / 5)

Both size and out_size are function arguments and are size_t.
If the caller is tricked by an attacker to give an unreasonably large value for size, then this arithmetic could overflow and fail to detect the error condition, which would lead to memory corruption.
TagsNo tags attached.

Activities

Christian Grothoff

2020-04-03 16:52

manager   ~0015513

Eh, I already added

  GNUNET_assert (size < SIZE_MAX / 8 - 4);

In response to your first bug of this type. Please 'git pull'.

Christian Grothoff

2020-04-03 16:52

manager   ~0015514

Already fixed earlier.

schanzen

2020-07-09 07:17

administrator   ~0016431

0.13.0 released

Issue History

Date ModifiedUsernameFieldChange
2020-04-03 10:41fefeNew Issue
2020-04-03 16:52Christian GrothoffNote Added: 0015513
2020-04-03 16:52Christian GrothoffAssigned To => Christian Grothoff
2020-04-03 16:52Christian GrothoffStatusnew => resolved
2020-04-03 16:52Christian GrothoffResolutionopen => fixed
2020-04-03 16:52Christian GrothoffFixed in Version => 0.12.3
2020-04-03 16:52Christian GrothoffNote Added: 0015514
2020-04-03 16:52Christian GrothoffFixed in Version0.12.3 => 0.12.2
2020-04-03 16:52Christian GrothoffTarget Version => 0.12.2
2020-04-23 08:45schanzenFixed in Version0.12.2 => 0.13.0
2020-04-23 08:47schanzenTarget Version0.12.2 => 0.13.0
2020-05-31 22:49AdminknoxIssue cloned: 0006319
2020-05-31 22:52AdminknoxIssue cloned: 0006351
2020-07-09 07:17schanzenNote Added: 0016431
2020-07-09 07:17schanzenStatusresolved => closed