View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0008050 | GNUnet | util library | public | 2024-01-09 17:22 | 2024-03-07 19:25 |
| Reporter | fefe | Assigned To | Christian Grothoff | Due Date | |
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | closed | Resolution | reopened | ||
| Fixed in Version | 0.21.0 | ||||
| Summary | 0008050: GNUNET_STRINGS_parse_ipv6_policy: integer overflow | ||||
| Description | This is in gnunet/src/lib/util/strings.c: 1474 unsigned int count; 1476 unsigned int len; 1491 len = strlen (routeListX); len should be a size_t to prevent truncation here. 1495 count = 0; 1496 for (i = 0; i < len; i++) 1497 if (';' == routeList[i]) 1498 count++; count could be arbitrarily large here, up to and including 0xffffffff. 1508 result = GNUNET_malloc (sizeof(struct GNUNET_STRINGS_IPv6NetworkPolicy) 1509 * (count + 1)); The fact that count is an unsigned int, the multiplication cannot overflow, but the addition can, leading to a 0 byte allocation. count should be a size_t and there should be integer overflow checking here. | ||||
| Tags | No tags attached. | ||||
| Fix committed to master branch. | |
| The fix causes tests in util for fail and other palces as well where this is parsed in particular test_regex in util for a simple case but parsers in transport communicators also seem to be affected. | |
| Fixed regression in 505d22064..08c15135e | |
| 0.21 released | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2024-01-09 17:22 | fefe | New Issue | |
| 2024-01-09 18:49 | Christian Grothoff | ||
| 2024-01-09 18:49 | Christian Grothoff | Note Added: 0020853 | |
| 2024-01-09 18:49 | Christian Grothoff | Assigned To | => Christian Grothoff |
| 2024-01-09 18:49 | Christian Grothoff | Status | new => resolved |
| 2024-01-09 18:49 | Christian Grothoff | Resolution | open => fixed |
| 2024-01-09 19:10 | Christian Grothoff | Project | Taler => GNUnet |
| 2024-01-09 19:10 | Christian Grothoff | Category | other => util library |
| 2024-03-01 10:19 | schanzen | Status | resolved => feedback |
| 2024-03-01 10:19 | schanzen | Resolution | fixed => reopened |
| 2024-03-01 10:19 | schanzen | Note Added: 0021598 | |
| 2024-03-01 11:32 | Christian Grothoff | Note Added: 0021601 | |
| 2024-03-01 11:32 | Christian Grothoff | Status | feedback => resolved |
| 2024-03-01 11:32 | Christian Grothoff | Fixed in Version | => 0.21.0 |
| 2024-03-07 19:25 | schanzen | Note Added: 0021794 | |
| 2024-03-07 19:25 | schanzen | Status | resolved => closed |