Re:OpenSSL 3.0.7 Published
by botplaysdice on Tuesday November 01, 2022 @01:24PM
(#33424293)
quick question, I didn't look into the detail of the issue and novice on Rust as well - question is to whom already checked detail of the vulnerability, is this bug kind of ones we can prevent if we're using Rust instead of C?
[ Parent
| on HN ]
Re:OpenSSL 3.0.7 Published
by formerly_proven on Tuesday November 01, 2022 @01:30PM
(#33424409)
Bog standard buffer overflow caused by incorrect bounds checking. Yes.
Indeed. For illustration, the Ubuntu commits that fix the two CVEs:
https://git.launchpad.net/ubuntu/+source/openssl/commit/?h=a...
- if (written_out > max_out)
+ if (written_out >= max_out)
[...]
- if (tmpptr != NULL)
- PUSHC('.');
+ PUSHC(tmpptr != NULL ? '.' : '\0');
- char a_ulabel[LABEL_BUF_SIZE];
+ char a_ulabel[LABEL_BUF_SIZE + 1];
- || type->origin == EVP_ORIG_METH) {
+ || (type != NULL && type->origin == EVP_ORIG_METH)
+ || (type == NULL && ctx->digest != NULL
+ && ctx->digest->origin == EVP_ORIG_METH)) {
- || impl != NULL) {
+ || impl != NULL
+ || (cipher != NULL && cipher->origin == EVP_ORIG_METH)
+ || (cipher == NULL && ctx->cipher != NULL
+ && ctx->cipher->origin == EVP_ORIG_METH)) {