View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0009279 | GNUnet | util library | public | 2024-10-18 13:02 | 2024-10-29 19:56 |
| Reporter | fefe | Assigned To | schanzen | Due Date | |
| Priority | normal | Severity | minor | Reproducibility | have not tried |
| Status | closed | Resolution | fixed | ||
| Product Version | Git master | ||||
| Target Version | 0.22.2 | Fixed in Version | 0.22.2 | ||
| Summary | 0009279: GNUNET_buffer_write_data_encoded: integer overflow | ||||
| Description | In buffer.c: 264 void 265 GNUNET_buffer_write_data_encoded (struct GNUNET_Buffer *buf, 266 const void *data, 267 size_t data_len) 268 { 269 size_t outlen = data_len * 8; This can overflow. 271 if (outlen % 5 > 0) 272 outlen += 5 - outlen % 5; 273 outlen /= 5; Line 272 can overflow. It's probably better to write this as: int roundup = (outlen % 5 > 0); outlen = (outlen / 5) + roundup; | ||||
| Tags | No tags attached. | ||||
| actually since *8 means we can always add 0..7 without overflow checking, you could write it as outlen = (outlen + 4) / 5; | |
| I don't understand the comment: We can assert that (data_len <= SIZE_MAX / 8) such that line 269 does not overflow. But if data_len == SIZE_MAX / 8 then the above will overflow surely? | |
| The *8 can overflow (and I didn't quote line 270 which checks for it IIRC) but not the +4. integer * 8 is like a left shift by three. The rightmost 3 bits will always be zero. Which means you can add up to 7 without overflow check. | |
| Fix committed to master branch. | |
| Released | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2024-10-18 13:02 | fefe | New Issue | |
| 2024-10-18 13:18 | fefe | Note Added: 0023545 | |
| 2024-10-23 11:20 | schanzen | Target Version | => 0.22.2 |
| 2024-10-23 19:34 | schanzen | Note Added: 0023579 | |
| 2024-10-23 19:34 | schanzen | Assigned To | => schanzen |
| 2024-10-23 19:34 | schanzen | Status | new => assigned |
| 2024-10-24 10:37 | fefe | Note Added: 0023588 | |
| 2024-10-24 11:25 | schanzen | ||
| 2024-10-24 11:25 | schanzen | Note Added: 0023591 | |
| 2024-10-24 11:25 | schanzen | Status | assigned => resolved |
| 2024-10-24 11:25 | schanzen | Resolution | open => fixed |
| 2024-10-24 11:26 | schanzen | Fixed in Version | => 0.22.2 |
| 2024-10-29 19:56 | schanzen | Note Added: 0023630 | |
| 2024-10-29 19:56 | schanzen | Status | resolved => closed |