View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0006159GNUnetutil librarypublic2020-04-03 14:372020-07-09 07:17
Reporterfefe Assigned ToChristian Grothoff Due Date
PrioritynormalSeverityminorReproducibilityN/A
Status closedResolutionfixed 
Product VersionGit master 
Target Version0.13.0Fixed in Version0.13.0 
Summary0006159: Integer overflow in GNUNET_STRINGS_base64_encode
Description1865 opt = GNUNET_malloc (2 + (len * 4 / 3) + 8);

len is a size_t and caller-supplied. If the caller accidentally or maliciously calls this function with a very large len, then the multiplication will overflow.

Recommendation: have a sanity check on len first.
TagsNo tags attached.

Activities

fefe

2020-04-03 14:38

reporter   ~0015507

Similar issue a few lines down in GNUNET_STRINGS_base64_decode.

Christian Grothoff

2020-04-03 14:59

manager   ~0015508

Well, and here I was thinking libgnunetutil would be out-of-scope and we'd first audit that code ourselves before having you face the horrors. Well, happy to fix those now. ;-)

Christian Grothoff

2020-04-03 15:08

manager   ~0015509

Should be fixed in 0541fd194..55bff52a2

schanzen

2020-07-09 07:17

administrator   ~0016428

0.13.0 released

Issue History

Date ModifiedUsernameFieldChange
2020-04-03 14:37fefeNew Issue
2020-04-03 14:38fefeNote Added: 0015507
2020-04-03 14:57Christian GrothoffAssigned To => Christian Grothoff
2020-04-03 14:57Christian GrothoffStatusnew => assigned
2020-04-03 14:59Christian GrothoffNote Added: 0015508
2020-04-03 15:08Christian GrothoffNote Added: 0015509
2020-04-03 15:08Christian GrothoffFixed in Version => 0.12.2
2020-04-03 15:08Christian GrothoffTarget Version => 0.12.2
2020-04-03 15:08Christian GrothoffStatusassigned => resolved
2020-04-03 15:08Christian GrothoffResolutionopen => fixed
2020-04-23 08:45schanzenFixed in Version0.12.2 => 0.13.0
2020-04-23 08:47schanzenTarget Version0.12.2 => 0.13.0
2020-05-31 22:49AdminknoxIssue cloned: 0006316
2020-05-31 22:52AdminknoxIssue cloned: 0006348
2020-07-09 07:17schanzenNote Added: 0016428
2020-07-09 07:17schanzenStatusresolved => closed