GnuTLS | Null Pointer Dereference in `wrap_nettle_mac_fast()` via `gnutls_hmac_fast()` (#1897)

Read-only notification of GnuTLS library development activities <[email protected]> Thu, 04 Jun 2026 18:30:00 +0000
Newsgroups gmane.comp.encryption.gpg.gnutls.devel
Message-ID <[email protected]> 
--===============2390680251215167844==
Content-Type: multipart/alternative;
 boundary="--==_mimepart_6a21c428433f5_37135ef34327038";
 charset=UTF-8
Content-Transfer-Encoding: 7bit


----==_mimepart_6a21c428433f5_37135ef34327038
Content-Type: text/plain;
 charset=UTF-8
Content-Transfer-Encoding: 7bit



Issue created by Kery: https://gitlab.com/gnutls/gnutls/-/work_items/1897



This report was generated with AI assistance and manually verified.

## Description of problem:

The exported API `gnutls_hmac_fast()` can dispatch to the Nettle MAC backend with `ptext == NULL` and `ptext_len > 0`. The internal backend `wrap_nettle_mac_fast()` forwards the unchecked pointer to `ctx.update()`, causing a NULL pointer read in the underlying Nettle update routine.

The harness calls the exported `gnutls_hmac_fast()` API. It does not directly call the internal static function.

Affected code:

```text
lib/nettle/mac.c:493      ctx.update(&ctx, text_size, text)
lib/hash_int.c:210       _gnutls_mac_fast(...)
lib/crypto-api.c:803     gnutls_hmac_fast(...)
```

This is a negative-argument API robustness issue: the reproducer passes `NULL + nonzero length`.

## Version of gnutls used:

```text
Upstream origin/master
Commit: 0b9fcb47c734191695b7b7812a0ba30a5c712b9f
Commit date: 2026-06-02 10:05:44 +0900
Configure summary version: 3.8.13 shared 72:0:42
```

## Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)

```text
Upstream source build, not a distribution package.
Built locally on Ubuntu with glibc 2.39.
```

## How reproducible:

```text
Always reproducible with the harness when GNUTLS_CPUID_OVERRIDE=0x1 is used to select the plain Nettle backend.
```

Steps to Reproduce:

 * Build GnuTLS from the commit above with hardening and sanitizers:

```text
CPPFLAGS=-D_FORTIFY_SOURCE=3
CFLAGS=-O2 -g -fno-omit-frame-pointer -fsanitize=address,undefined -fstack-protector-strong -fPIE
LDFLAGS=-fsanitize=address,undefined -Wl,-z,relro -Wl,-z,now -pie
```

The verified library was:

```text
<build-dir>/lib/.libs/libgnutls.so.30.42.0
SHA-256: 224c60682088ac07680c1eba04acd159b51bd8995bedcbc1fc288fe248a1058b
```

 * Compile the reproducer:

Reproducer source: [hmac_null_text.c](https://github.com/Bin-infinite/vuln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/latest/%63%61%73%65%2D003/pocs/hmac_null_text.c)

The core call is:

```c
gnutls_hmac_fast(GNUTLS_MAC_SHA256, key, sizeof(key), NULL, 1, digest);
```

 * Run the reproducer:

```bash
ASAN_OPTIONS='abort_on_error=1:symbolize=1:detect_leaks=0:allocator_may_return_null=1' \
UBSAN_OPTIONS='halt_on_error=0:print_stacktrace=1' \
LSAN_OPTIONS='detect_leaks=0' \
GNUTLS_CPUID_OVERRIDE=0x1 \
./hmac_null_text
```

## Actual results:

ASan reports a NULL read:

```text
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000
The signal is caused by a READ memory access.
#0 memcpy /usr/include/x86_64-linux-gnu/bits/string_fortified.h:29
#1 nettle_sha256_update nettle-3.10.2-nofat/sha256.c:124
#2 wrap_nettle_mac_fast lib/nettle/mac.c:493
#3 _gnutls_mac_fast lib/hash_int.c:210
#4 gnutls_hmac_fast lib/crypto-api.c:803
#5 main hmac_null_text.c:22
```

Full log: [hmac_null_text_run1.stderr.txt](https://github.com/Bin-infinite/vuln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/latest/%63%61%73%65%2D003/runs/hmac_null_text_run1.stderr.txt)

## Expected results:

`gnutls_hmac_fast()` should reject `ptext == NULL && ptext_len > 0` with a negative error code, such as `GNUTLS_E_INVALID_REQUEST`, before invoking backend callbacks. Related NULL argument combinations should be validated centrally so all MAC providers behave consistently.

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1897
You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/5-8f3zngvizwjnituafwz6vkp14-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help



----==_mimepart_6a21c428433f5_37135ef34327038
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www=
.w3.org/TR/REC-html40/loose.dtd">
<html lang=3D"en" style=3D'--code-editor-font: var(--default-mono-font, "=
GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, =
Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospac=
e;'>
<head>
<meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Type">=

<title>
GitLab
</title>

<style data-premailer=3D"ignore" type=3D"text/css">
a { color: #1068bf; }
</style>

<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Ro=
boto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Colo=
r Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size=
: inherit;
}
</style>
</head>
<body style=3D'font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.0=
1) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"=
Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif=
,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji=
";'>
<div class=3D"content">

<p class=3D"details" style=3D"font-style: italic; color: #626168;">
Issue created by <a href=3D"https://gitlab.com/Keryer">Kery</a>: <a href=3D=
"https://gitlab.com/gnutls/gnutls/-/work_items/1897">#1897</a>
</p>
<div class=3D"md" style=3D"position: relative; z-index: 1; color: #3a383f=
; word-wrap: break-word;">
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">This report was generated with AI assistance and manually verifi=
ed.</p>
<h2 id=3D"user-content-description-of-problem" dir=3D"auto" style=3D"marg=
in-top: 20px; margin-bottom: 10px;" align=3D"initial">Description of prob=
lem:<a href=3D"#description-of-problem" aria-label=3D"Link to heading 'De=
scription of problem:'" data-heading-content=3D"Description of problem:" =
class=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The exported API <code style=3D'font-size: 90%; color: #18171d; =
word-wrap: break-word; background-color: #ececef; border-radius: .25rem; =
margin-top: 0px; font-weight: inherit; overflow-wrap: break-word; white-s=
pace: break-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo"=
, "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Cour=
ier New", "andale mono", "lucida console", monospace; font-variant-ligatu=
res: none; word-break: keep-all; padding: 0.125rem 0.25rem;'>gnutls_hmac_=
fast()</code> can dispatch to the Nettle MAC backend with <code style=3D'=
font-size: 90%; color: #18171d; word-wrap: break-word; background-color: =
#ececef; border-radius: .25rem; font-weight: inherit; overflow-wrap: brea=
k-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains=
 Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubun=
tu Mono", "Courier New", "andale mono", "lucida console", monospace; font=
-variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem=
;'>ptext =3D=3D NULL</code> and <code style=3D'font-size: 90%; color: #18=
171d; word-wrap: break-word; background-color: #ececef; border-radius: .2=
5rem; font-weight: inherit; overflow-wrap: break-word; white-space: break=
-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu S=
ans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "=
andale mono", "lucida console", monospace; font-variant-ligatures: none; =
word-break: keep-all; padding: 0.125rem 0.25rem;'>ptext_len &gt; 0</code>=
. The internal backend <code style=3D'font-size: 90%; color: #18171d; wor=
d-wrap: break-word; background-color: #ececef; border-radius: .25rem; fon=
t-weight: inherit; overflow-wrap: break-word; white-space: break-spaces; =
font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono"=
, "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mo=
no", "lucida console", monospace; font-variant-ligatures: none; word-brea=
k: keep-all; padding: 0.125rem 0.25rem;'>wrap_nettle_mac_fast()</code> fo=
rwards the unchecked pointer to <code style=3D'font-size: 90%; color: #18=
171d; word-wrap: break-word; background-color: #ececef; border-radius: .2=
5rem; font-weight: inherit; overflow-wrap: break-word; white-space: break=
-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu S=
ans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "=
andale mono", "lucida console", monospace; font-variant-ligatures: none; =
word-break: keep-all; padding: 0.125rem 0.25rem;'>ctx.update()</code>, ca=
using a NULL pointer read in the underlying Nettle update routine.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The harness calls the exported <code style=3D'font-size: 90%; co=
lor: #18171d; word-wrap: break-word; background-color: #ececef; border-ra=
dius: .25rem; margin-top: 0px; font-weight: inherit; overflow-wrap: break=
-word; white-space: break-spaces; font-family: "GitLab Mono", "JetBrains =
Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubunt=
u Mono", "Courier New", "andale mono", "lucida console", monospace; font-=
variant-ligatures: none; word-break: keep-all; padding: 0.125rem 0.25rem;=
'>gnutls_hmac_fast()</code> API. It does not directly call the internal s=
tatic function.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Affected code:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
 Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">lib/nettle/mac.c:493      ctx.update(&amp;ctx, text_size, text)</=
span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">lib/hash_int.c:210    =
   _gnutls_mac_fast(...)</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">lib/crypto-api.c:803  =
   gnutls_hmac_fast(...)</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">This is a negative-argument API robustness issue: the reproducer=
 passes <code style=3D'font-size: 90%; color: #18171d; word-wrap: break-w=
ord; background-color: #ececef; border-radius: .25rem; margin-top: 0px; f=
ont-weight: inherit; overflow-wrap: break-word; white-space: break-spaces=
; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mon=
o", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale =
mono", "lucida console", monospace; font-variant-ligatures: none; word-br=
eak: keep-all; padding: 0.125rem 0.25rem;'>NULL + nonzero length</code>.<=
/p>
<h2 id=3D"user-content-version-of-gnutls-used" dir=3D"auto" style=3D"marg=
in-top: 20px; margin-bottom: 10px;" align=3D"initial">Version of gnutls u=
sed:<a href=3D"#version-of-gnutls-used" aria-label=3D"Link to heading 'Ve=
rsion of gnutls used:'" data-heading-content=3D"Version of gnutls used:" =
class=3D"anchor" style=3D"margin-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
 Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Upstream origin/master</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">Commit: 0b9fcb47c73419=
1695b7b7812a0ba30a5c712b9f</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">Commit date: 2026-06-0=
2 10:05:44 +0900</span>
<span id=3D"LC4" class=3D"line" lang=3D"plaintext">Configure summary vers=
ion: 3.8.13 shared 72:0:42</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-distributor-of-gnutls-eg-ubuntu-fedora-rhel" dir=3D=
"auto" style=3D"margin-top: 20px; margin-bottom: 10px;" align=3D"initial"=
>Distributor of gnutls (e.g., Ubuntu, Fedora, RHEL)<a href=3D"#distributo=
r-of-gnutls-eg-ubuntu-fedora-rhel" aria-label=3D"Link to heading 'Distrib=
utor of gnutls (e.g., Ubuntu, Fedora, RHEL)'" data-heading-content=3D"Dis=
tributor of gnutls (e.g., Ubuntu, Fedora, RHEL)" class=3D"anchor" style=3D=
"margin-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
 Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Upstream source build, not a distribution package.</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">Built locally on Ubunt=
u with glibc 2.39.</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-how-reproducible" dir=3D"auto" style=3D"margin-top=
: 20px; margin-bottom: 10px;" align=3D"initial">How reproducible:<a href=3D=
"#how-reproducible" aria-label=3D"Link to heading 'How reproducible:'" da=
ta-heading-content=3D"How reproducible:" class=3D"anchor" style=3D"margin=
-top: 0px;"></a>
</h2>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
 Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">Always reproducible with the harness when GNUTLS_CPUID_OVERRIDE=3D=
0x1 is used to select the plain Nettle backend.</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Steps to Reproduce:</p>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Build GnuTLS from the commit above with hardening and san=
itizers:</li>
</ul>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
 Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">CPPFLAGS=3D-D_FORTIFY_SOURCE=3D3</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">CFLAGS=3D-O2 -g -fno-o=
mit-frame-pointer -fsanitize=3Daddress,undefined -fstack-protector-strong=
 -fPIE</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">LDFLAGS=3D-fsanitize=3D=
address,undefined -Wl,-z,relro -Wl,-z,now -pie</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The verified library was:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
 Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">&lt;build-dir&gt;/lib/.libs/libgnutls.so.30.42.0</span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">SHA-256: 224c60682088a=
c07680c1eba04acd159b51bd8995bedcbc1fc288fe248a1058b</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Compile the reproducer:</li>
</ul>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Reproducer source: <a href=3D"https://github.com/Bin-infinite/vu=
ln-validations/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/lates=
t/%63%61%73%65%2D003/pocs/hmac_null_text.c" rel=3D"nofollow noreferrer no=
opener" target=3D"_blank" style=3D"margin-top: 0px;">hmac_null_text.c</a>=
</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">The core call is:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"c" class=3D"code highlight js-syntax-highligh=
t language-c" v-pre=3D"true" style=3D'display: block; font-size: 14px; co=
lor: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius: .25rem=
; position: relative; font-family: "GitLab Mono", "JetBrains Mono", "Menl=
o", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Co=
urier New", "andale mono", "lucida console", monospace; font-variant-liga=
tures: none; word-break: break-all; word-wrap: break-word; background-col=
or: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid #dcdcde=
;'><code style=3D'font-size: inherit; color: inherit; word-wrap: normal; =
word-break: keep-all; background-color: inherit; border-radius: .25rem; w=
hite-space: pre; margin-top: 0px; font-family: "GitLab Mono", "JetBrains =
Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubunt=
u Mono", "Courier New", "andale mono", "lucida console", monospace; font-=
variant-ligatures: none; overflow-wrap: normal; padding: unset;'><span id=
=3D"LC1" class=3D"line" lang=3D"c" style=3D"margin-top: 0px;"><span class=
=3D"n" style=3D"margin-top: 0px;">gnutls_hmac_fast</span><span class=3D"p=
">(</span><span class=3D"n">GNUTLS_MAC_SHA256</span><span class=3D"p">,</=
span> <span class=3D"n">key</span><span class=3D"p">,</span> <span class=3D=
"k">sizeof</span><span class=3D"p">(</span><span class=3D"n">key</span><s=
pan class=3D"p">),</span> <span class=3D"nb">NULL</span><span class=3D"p"=
>,</span> <span class=3D"mi">1</span><span class=3D"p">,</span> <span cla=
ss=3D"n">digest</span><span class=3D"p">);</span></span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<ul dir=3D"auto" style=3D"text-align: initial; list-style-type: disc; mar=
gin: 0px 0px 1rem; padding: 0;">
<li style=3D"margin-top: 0px; line-height: 1.6em; margin-left: 25px; padd=
ing-left: 3px;">Run the reproducer:</li>
</ul>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"bash" class=3D"code highlight js-syntax-highl=
ight language-shell" v-pre=3D"true" style=3D'display: block; font-size: 1=
4px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-radius:=
 .25rem; position: relative; font-family: "GitLab Mono", "JetBrains Mono"=
, "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mon=
o", "Courier New", "andale mono", "lucida console", monospace; font-varia=
nt-ligatures: none; word-break: break-all; word-wrap: break-word; backgro=
und-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px solid =
#dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wrap: n=
ormal; word-break: keep-all; background-color: inherit; border-radius: .2=
5rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", "Jet=
Brains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas",=
 "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monospace=
; font-variant-ligatures: none; overflow-wrap: normal; padding: unset;'><=
span id=3D"LC1" class=3D"line" lang=3D"shell" style=3D"margin-top: 0px;">=
<span class=3D"nv" style=3D"margin-top: 0px;">ASAN_OPTIONS</span><span cl=
ass=3D"o">=3D</span><span class=3D"s1">'abort_on_error=3D1:symbolize=3D1:=
detect_leaks=3D0:allocator_may_return_null=3D1'</span> <span class=3D"se"=
>\</span></span>
<span id=3D"LC2" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">UBSAN_OPTIONS</span><span class=3D"o">=3D</span><span =
class=3D"s1">'halt_on_error=3D0:print_stacktrace=3D1'</span> <span class=3D=
"se">\</span></span>
<span id=3D"LC3" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">LSAN_OPTIONS</span><span class=3D"o">=3D</span><span c=
lass=3D"s1">'detect_leaks=3D0'</span> <span class=3D"se">\</span></span>
<span id=3D"LC4" class=3D"line" lang=3D"shell"><span class=3D"nv" style=3D=
"margin-top: 0px;">GNUTLS_CPUID_OVERRIDE</span><span class=3D"o">=3D</spa=
n>0x1 <span class=3D"se">\</span></span>
<span id=3D"LC5" class=3D"line" lang=3D"shell">./hmac_null_text</span></c=
ode></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<h2 id=3D"user-content-actual-results" dir=3D"auto" style=3D"margin-top: =
20px; margin-bottom: 10px;" align=3D"initial">Actual results:<a href=3D"#=
actual-results" aria-label=3D"Link to heading 'Actual results:'" data-hea=
ding-content=3D"Actual results:" class=3D"anchor" style=3D"margin-top: 0p=
x;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">ASan reports a NULL read:</p>
<div class=3D"gl-relative markdown-code-block js-markdown-code">
<pre data-canonical-lang=3D"text" class=3D"code highlight js-syntax-highl=
ight language-plaintext" v-pre=3D"true" style=3D'display: block; font-siz=
e: 14px; color: #3a383f; line-height: 1.6em; overflow-x: auto; border-rad=
ius: .25rem; position: relative; font-family: "GitLab Mono", "JetBrains M=
ono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu=
 Mono", "Courier New", "andale mono", "lucida console", monospace; font-v=
ariant-ligatures: none; word-break: break-all; word-wrap: break-word; bac=
kground-color: #fbfafd; margin: 0px 0 1rem; padding: 12px; border: 1px so=
lid #dcdcde;'><code style=3D'font-size: inherit; color: inherit; word-wra=
p: normal; word-break: keep-all; background-color: inherit; border-radius=
: .25rem; white-space: pre; margin-top: 0px; font-family: "GitLab Mono", =
"JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", "Consol=
as", "Ubuntu Mono", "Courier New", "andale mono", "lucida console", monos=
pace; font-variant-ligatures: none; overflow-wrap: normal; padding: unset=
;'><span id=3D"LC1" class=3D"line" lang=3D"plaintext" style=3D"margin-top=
: 0px;">ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000</=
span>
<span id=3D"LC2" class=3D"line" lang=3D"plaintext">The signal is caused b=
y a READ memory access.</span>
<span id=3D"LC3" class=3D"line" lang=3D"plaintext">#0 memcpy /usr/include=
/x86_64-linux-gnu/bits/string_fortified.h:29</span>
<span id=3D"LC4" class=3D"line" lang=3D"plaintext">#1 nettle_sha256_updat=
e nettle-3.10.2-nofat/sha256.c:124</span>
<span id=3D"LC5" class=3D"line" lang=3D"plaintext">#2 wrap_nettle_mac_fas=
t lib/nettle/mac.c:493</span>
<span id=3D"LC6" class=3D"line" lang=3D"plaintext">#3 _gnutls_mac_fast li=
b/hash_int.c:210</span>
<span id=3D"LC7" class=3D"line" lang=3D"plaintext">#4 gnutls_hmac_fast li=
b/crypto-api.c:803</span>
<span id=3D"LC8" class=3D"line" lang=3D"plaintext">#5 main hmac_null_text=
.c:22</span></code></pre>
<copy-code></copy-code><insert-code-snippet></insert-code-snippet>
</div>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">Full log: <a href=3D"https://github.com/Bin-infinite/vuln-valida=
tions/blob/f47f650ccab29d5be069fe5418a8ae2a7ec23d51/gnutls/latest/%63%61%=
73%65%2D003/runs/hmac_null_text_run1.stderr.txt" rel=3D"nofollow noreferr=
er noopener" target=3D"_blank" style=3D"margin-top: 0px;">hmac_null_text_=
run1.stderr.txt</a></p>
<h2 id=3D"user-content-expected-results" dir=3D"auto" style=3D"margin-top=
: 20px; margin-bottom: 10px;" align=3D"initial">Expected results:<a href=3D=
"#expected-results" aria-label=3D"Link to heading 'Expected results:'" da=
ta-heading-content=3D"Expected results:" class=3D"anchor" style=3D"margin=
-top: 0px;"></a>
</h2>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px;" align=3D"initial">=
<code style=3D'font-size: 90%; color: #18171d; word-wrap: break-word; bac=
kground-color: #ececef; border-radius: .25rem; margin-top: 0px; font-weig=
ht: inherit; overflow-wrap: break-word; white-space: break-spaces; font-f=
amily: "GitLab Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Lib=
eration Mono", "Consolas", "Ubuntu Mono", "Courier New", "andale mono", "=
lucida console", monospace; font-variant-ligatures: none; word-break: kee=
p-all; padding: 0.125rem 0.25rem;'>gnutls_hmac_fast()</code> should rejec=
t <code style=3D'font-size: 90%; color: #18171d; word-wrap: break-word; b=
ackground-color: #ececef; border-radius: .25rem; font-weight: inherit; ov=
erflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab =
Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", =
"Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console"=
, monospace; font-variant-ligatures: none; word-break: keep-all; padding:=
 0.125rem 0.25rem;'>ptext =3D=3D NULL &amp;&amp; ptext_len &gt; 0</code> =
with a negative error code, such as <code style=3D'font-size: 90%; color:=
 #18171d; word-wrap: break-word; background-color: #ececef; border-radius=
: .25rem; font-weight: inherit; overflow-wrap: break-word; white-space: b=
reak-spaces; font-family: "GitLab Mono", "JetBrains Mono", "Menlo", "Deja=
Vu Sans Mono", "Liberation Mono", "Consolas", "Ubuntu Mono", "Courier New=
", "andale mono", "lucida console", monospace; font-variant-ligatures: no=
ne; word-break: keep-all; padding: 0.125rem 0.25rem;'>GNUTLS_E_INVALID_RE=
QUEST</code>, before invoking backend callbacks. Related NULL argument co=
mbinations should be validated centrally so all MAC providers behave cons=
istently.</p>
</div>

</div>
<div class=3D"footer" style=3D"margin-top: 10px;">
<p style=3D"font-size: small; color: #626168;">
=E2=80=94
<br>
Reply to this email directly or <a href=3D"https://gitlab.com/gnutls/gnut=
ls/-/work_items/1897">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target=3D"_blan=
k" rel=3D"noopener noreferrer" href=3D"https://gitlab.com">gitlab.com</a>=
. <a href=3D"https://gitlab.com/-/sent_notifications/5-8f3zngvizwjnituafw=
z6vkp14-a84t7/unsubscribe" target=3D"_blank" rel=3D"noopener noreferrer">=
Unsubscribe</a> from this thread =C2=B7 <a href=3D"https://gitlab.com/-/p=
rofile/notifications" target=3D"_blank" rel=3D"noopener noreferrer" class=
=3D"mng-notif-link">Manage all notifications</a> =C2=B7 <a href=3D"https:=
//gitlab.com/help" target=3D"_blank" rel=3D"noopener noreferrer" class=3D=
"help-link">Help</a>
<span style=3D"color: transparent; font-size: 0; display: none; overflow:=
 hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/work_it=
ems/1897 at 1780597800
</span>
<script type=3D"application/ld+json">{"@context":"http://schema.org","@ty=
pe":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item"=
,"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1897"}}</script>


</p>
</div>
</body>
</html>

----==_mimepart_6a21c428433f5_37135ef34327038--


--===============2390680251215167844==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Gnutls-devel mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-devel

--===============2390680251215167844==--