View Issue Details

IDProjectCategoryView StatusLast Update
0008100Talerexchangepublic2024-03-07 19:47
Reporterfefe Assigned ToChristian Grothoff Resolution deadline
ImplementerReviewer 
Release signed byDeployed by 
VerifierCommunicator 
Data protection authority notification requiredNo  
CSIRT notification requiredNo  
Estimated effort (hours)Actual effort (hours)0 
Fast-trackNo
Work packagenone
PrioritynormalSeverityminorReproducibilityhave not tried
Status closedResolutionfixed 
Product Versiongit (master) 
Target Version0.9.4Fixed in Version0.9.4 
Summary0008100: parse_restrictions: integer truncation
DescriptionThis is in exchange/src/lib/exchange_api_common.c:

  412 static enum GNUNET_GenericReturnValue
  413 parse_restrictions (const json_t *jresta,
  414 unsigned int *resta_len,
  415 struct TALER_EXCHANGE_AccountRestriction **resta)

  422 *resta_len = json_array_size (jresta);

json_array_size returns size_t, so resta_len should either be a size_t* orr there should be a check or assertion here to make sure no truncation happened.
TagsNo tags attached.

Required notifications

Address or linkRemarkAdded byNotifiedActions

Relationships

child of 0008112 implementingoec Merchant security review 

Activities

Christian Grothoff

2024-01-17 18:34

manager   ~0020901

Fixed in 91969f18..3db8ffe5 (by first assigning to a size_t, then asserting that unsigned int doens't change the numeric value).

Issue History

Date ModifiedUsernameFieldChange
2024-01-17 14:48fefeNew Issue
2024-01-17 14:48fefeStatusnew => assigned
2024-01-17 14:48fefeAssigned To => Christian Grothoff
2024-01-17 18:34Christian GrothoffStatusassigned => informing
2024-01-17 18:34Christian GrothoffResolutionopen => fixed
2024-01-17 18:34Christian GrothoffFixed in Version => 0.9.4
2024-01-17 18:34Christian GrothoffNote Added: 0020901
2024-01-17 18:35Christian GrothoffProduct Version => git (master)
2024-01-17 18:35Christian GrothoffTarget Version => 0.9.4
2024-01-18 22:31Christian GrothoffRelationship addedchild of 0008112
2024-03-07 19:47Christian GrothoffStatusinforming => closed