View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0006217GNUnetutil librarypublic2020-04-23 13:122020-07-09 07:17
Reporterfefe Assigned ToFlorian Dold Due Date
PrioritynormalSeveritymajorReproducibilityhave not tried
Status closedResolutionfixed 
Product Version0.12.2 
Target Version0.13.0Fixed in Version0.13.0 
Summary0006217: integer overflow in GNUNET_buffer_ensure_remaining
DescriptionIn gnunet/src/util/buffer.c:

 53 void
 54 GNUNET_buffer_ensure_remaining (struct GNUNET_Buffer *buf, size_t n)
 55 {
 56 size_t new_capacity = buf->position + n;
 57
 58 if (new_capacity <= buf->capacity)
 59 return;

If n is unreasonably large, this arithmetic can overflow leading to the function returning without actually providing enough space.
This can lead to memory corruption and crashing.
TagsNo tags attached.

Activities

Florian Dold

2020-04-24 08:26

developer   ~0015776

Fixed in 892bd3c60

schanzen

2020-07-09 07:17

administrator   ~0016421

0.13.0 released

Issue History

Date ModifiedUsernameFieldChange
2020-04-23 13:12fefeNew Issue
2020-04-23 13:52Florian DoldAssigned To => Florian Dold
2020-04-23 13:52Florian DoldStatusnew => assigned
2020-04-24 08:26Florian DoldStatusassigned => resolved
2020-04-24 08:26Florian DoldResolutionopen => fixed
2020-04-24 08:26Florian DoldNote Added: 0015776
2020-04-24 08:30schanzenFixed in Version => 0.13.0
2020-04-24 08:30schanzenTarget Version => 0.13.0
2020-05-31 22:49AdminknoxIssue cloned: 0006307
2020-05-31 22:52AdminknoxIssue cloned: 0006340
2020-07-09 07:17schanzenNote Added: 0016421
2020-07-09 07:17schanzenStatusresolved => closed