Re: Buffer Overflow in Integer.cpp

On Fri, Oct 8, 2021 at 12:02 AM Jeffrey Walton <[email protected]> wrote:
>
> On Thu, Oct 7, 2021 at 5:11 AM Tony Stead <[email protected]> wrote:
> >
> > I have been using the Integer class for some big number operations and seem to have found a buffer overflow in at least the Integer::And routine, I have not yet inspected any more..
> >
> >  ...
> > The issue is casued in the temporary result variable.  When result copies t or this in its constructor, it calculates the minimum size required to fit the current number in t or this.  If the top order bits of t or this have gone zero it will allocate less bytes than the size of t or this.  However the following AndWords routine performs a copy using the size of the original number, either t or this.
> >
> > Changing the value to result.reg.size() appears to fix the issue at least for my use case.
>
> Thanks Tony.
>
> Do you have a reproducer? I'd like to look at it.
>
> We have test cases setup and they are run under the sanitizers. I
> don't recall seeing a finding. We might be missing a test case for it,
> however.

By the way, here's the test data we use for testing the integer
operations. It was generated using Java, so you should get the same
result between Crypto++ and Java. You can find the Java program at
http://github.com/weidai11/cryptopp/issues/336.

https://github.com/weidai11/cryptopp/blob/master/validat2.cpp#L34

Jeff

-- 
You received this message because you are subscribed to the Google Groups "Crypto++ Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/cryptopp-users/CAH8yC8%3DV0irdq2q0NuhWuOSz7d%3Db7c5%3Dntk0ra6R1M8wckzGrg%40mail.gmail.com.