GnuTLS | srptool: fix stack buffer overflow with large SRP groups (!2050)
Read-only notification of GnuTLS library development activities <[email protected]>
| Newsgroups | gmane.comp.encryption.gpg.gnutls.devel |
|---|---|
| Message-ID | <[email protected]> |
Mikhail created a merge request: https://gitlab.com/gnutls/gnutls/-/merge_requests/2050 Project:Branches: grey3228/gnutls:fix/large-srp-group-stack-buff-overflow to gnutls/gnutls:master Author: Mikhail The static buffer result in _srp_crypt() was only 1024 bytes, while the 8192-bit SRP group code produces base64-encoded verifier of 1366 characters. Using sprintf() with the old buffer caused a stack buffer overflow (undefined behaviour) when --index=6 or --index=7 was used. This MR: - increases the static buffer size to 2048 bytes (sufficient for all currently supported groups), - replaces sprintf() with snprintf() to prevent overflow even if the buffer were accidentally too small. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: #1777 ## Checklist * [x] Commits have `Signed-off-by:` with name/author being identical to the commit author * [x] Code modified for feature * [x] Test suite updated with functionality tests * [x] Test suite updated with negative tests * [x] Documentation updated / NEWS entry present (for non-trivial changes) ## Reviewer's checklist: * [ ] Any issues marked for closing are addressed * [ ] There is a test suite reasonably covering new functionality or modifications * [ ] Function naming, parameters, return values, types, etc., are consistent and according to `CONTRIBUTION.md` * [ ] This feature/change has adequate documentation added * [ ] No obvious mistakes in the code -- Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/2050 You're receiving this email because of your account on gitlab.com. _______________________________________________ Gnutls-devel mailing list [email protected] http://lists.gnupg.org/mailman/listinfo/gnutls-devel