Why did the OpenSSL punycode vulnerability happen

Re:Why did the OpenSSL punycode vulnerability happen by alserio on Wednesday November 02, 2022 @07:41PM (#33444444)

I'll give you a tautological and useless answer. I hope you don't mind. A parser is a kind of interpreter, where code is executed based on external input. When user input controls how code is executed you have opened the doors of hell: it's hard to guarantee that all of the possible executions are safe.

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by tester756 on Wednesday November 02, 2022 @07:43PM (#33444471)

But why?

Parsers executes safe code fragments in order based on the input

How safe operations result in unsafe results?

I'm not talking about side channels here.

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by alserio on Wednesday November 02, 2022 @07:47PM (#33444514)

Well, I see two ways it might be: the operations are not really safe in an absolute sense or the operations composition does not preserve safety. Or you could say that an operation can be safe in a context but ops+context does not compose as well as we would like to guarantee the preservation of safety

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by toast0 on Wednesday November 02, 2022 @08:21PM (#33444906)

Here's an even more tautological answer. You can't misparse input unless you're parsing input. That's why parsers have trouble with parsing input.

[ Parent | on HN ]

Re:Why did the OpenSSL punycode vulnerability happen by alserio on Monday November 07, 2022 @12:04PM (#33508611)

true

[ Parent | on HN ]