Re: GnuTLS | Null Pointer Dereference in `wrap_nettle_mac_fast()` via `gnutls_hmac_fast()` (#1897)
Read-only notification of GnuTLS library development activities <[email protected]> Thu, 04 Jun 2026 23:56:07 +0000
| Newsgroups | gmane.comp.encryption.gpg.gnutls.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============8360250217689686929==
Content-Type: multipart/alternative;
boundary="--==_mimepart_6a221096e4f79_371946a01159ac";
charset=UTF-8
Content-Transfer-Encoding: 7bit
----==_mimepart_6a221096e4f79_371946a01159ac
Content-Type: text/plain;
charset=UTF-8
Content-Transfer-Encoding: 7bit
Daiki Ueno commented: https://gitlab.com/gnutls/gnutls/-/work_items/1897#note_3424212659
> `gnutls_hmac_fast(GNUTLS_MAC_SHA256, key, sizeof(key), NULL, 1, digest);`
This is an API mis-use, which is out of scope of our threat model: https://gitlab.com/gnutls/gnutls/-/blob/master/SECURITY.md?ref_type=heads#threat-model
If we were to address it, that would be adding an `assert` to be clear that it is a programming error of the application.
Please stop reporting issues in this class of problems.
--
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/work_items/1897#note_3424212659
You're receiving this email because of your account on gitlab.com. Unsubscribe from this thread: https://gitlab.com/-/sent_notifications/5-7t0uol693f10is4mgw9m11pux-a84t7/unsubscribe | Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help
----==_mimepart_6a221096e4f79_371946a01159ac
Content-Type: text/html;
charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www=
.w3.org/TR/REC-html40/loose.dtd">
<html lang=3D"en" style=3D'--code-editor-font: var(--default-mono-font, "=
GitLab Mono"), JetBrains Mono, Menlo, DejaVu Sans Mono, Liberation Mono, =
Consolas, Ubuntu Mono, Courier New, andale mono, lucida console, monospac=
e;'>
<head>
<meta content=3D"text/html; charset=3Dutf-8" http-equiv=3D"Content-Type">=
<title>
GitLab
</title>
<style data-premailer=3D"ignore" type=3D"text/css">
a { color: #1068bf; }
</style>
<style>img {
max-width: 100%; height: auto;
}
body {
font-size: .875rem;
}
body {
-webkit-text-shadow: hsla(0,0%,100%,.01) 0 0 1px;
}
body {
font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"Segoe UI",Ro=
boto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif,"Apple Colo=
r Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"; font-size=
: inherit;
}
</style>
</head>
<body style=3D'font-size: inherit; -webkit-text-shadow: hsla(0,0%,100%,.0=
1) 0 0 1px; font-family: "GitLab Sans",-apple-system,BlinkMacSystemFont,"=
Segoe UI",Roboto,"Noto Sans",Ubuntu,Cantarell,"Helvetica Neue",sans-serif=
,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji=
";'>
<div class=3D"content">
<p style=3D"color: #777777;">
<a href=3D"https://gitlab.com/dueno">Daiki Ueno</a>
<a href=3D"https://gitlab.com/gnutls/gnutls/-/work_items/1897#note_342421=
2659">commented</a>:
</p>
<div class=3D"md" style=3D"position: relative; z-index: 1; color: #3a383f=
; word-wrap: break-word;">
<blockquote dir=3D"auto" style=3D"font-size: inherit; color: #626168; pad=
ding-top: 0.5rem; padding-bottom: 0.5rem; padding-left: 1rem; border-left=
-style: solid; margin: 0px 0px 0.5rem; border-color: #bfbfc3; border-widt=
h: 0 0 0 4px;" align=3D"initial">
<p style=3D"color: inherit; line-height: 1.5; margin: 0;"><code style=3D'=
font-size: 90%; color: #18171d; word-wrap: break-word; background-color: =
#ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; ov=
erflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab =
Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono", =
"Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console"=
, monospace; font-variant-ligatures: none; word-break: keep-all; padding:=
0.125rem 0.25rem;'>gnutls_hmac_fast(GNUTLS_MAC_SHA256, key, sizeof(key),=
NULL, 1, digest);</code></p>
</blockquote>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">This is an API mis-use, which is out of scope of our threat mode=
l: <a href=3D"https://gitlab.com/gnutls/gnutls/-/blob/master/SECURITY.md?=
ref_type=3Dheads#threat-model" style=3D"margin-top: 0px;">https://gitlab.=
com/gnutls/gnutls/-/blob/master/SECURITY.md?ref_type=3Dheads#threat-model=
</a></p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px 0px 1rem;" align=3D"=
initial">If we were to address it, that would be adding an <code style=3D=
'font-size: 90%; color: #18171d; word-wrap: break-word; background-color:=
#ececef; border-radius: .25rem; margin-top: 0px; font-weight: inherit; o=
verflow-wrap: break-word; white-space: break-spaces; font-family: "GitLab=
Mono", "JetBrains Mono", "Menlo", "DejaVu Sans Mono", "Liberation Mono",=
"Consolas", "Ubuntu Mono", "Courier New", "andale mono", "lucida console=
", monospace; font-variant-ligatures: none; word-break: keep-all; padding=
: 0.125rem 0.25rem;'>assert</code> to be clear that it is a programming e=
rror of the application.</p>
<p dir=3D"auto" style=3D"color: #3a383f; margin: 0px;" align=3D"initial">=
Please stop reporting issues in this class of problems.</p>
</div>
</div>
<div class=3D"footer" style=3D"margin-top: 10px;">
<p style=3D"font-size: small; color: #626168;">
=E2=80=94
<br>
Reply to this email directly or <a href=3D"https://gitlab.com/gnutls/gnut=
ls/-/work_items/1897#note_3424212659">view it on GitLab</a>.
<br>
You're receiving this email because of your account on <a target=3D"_blan=
k" rel=3D"noopener noreferrer" href=3D"https://gitlab.com">gitlab.com</a>=
. <a href=3D"https://gitlab.com/-/sent_notifications/5-7t0uol693f10is4mgw=
9m11pux-a84t7/unsubscribe" target=3D"_blank" rel=3D"noopener noreferrer">=
Unsubscribe</a> from this thread =C2=B7 <a href=3D"https://gitlab.com/-/p=
rofile/notifications" target=3D"_blank" rel=3D"noopener noreferrer" class=
=3D"mng-notif-link">Manage all notifications</a> =C2=B7 <a href=3D"https:=
//gitlab.com/help" target=3D"_blank" rel=3D"noopener noreferrer" class=3D=
"help-link">Help</a>
<span style=3D"color: transparent; font-size: 0; display: none; overflow:=
hidden; opacity: 0; width: 0; height: 0; max-width: 0; max-height: 0;">
Notification message regarding https://gitlab.com/gnutls/gnutls/-/work_it=
ems/1897#note_3424212659 at 1780617366
</span>
<script type=3D"application/ld+json">{"@context":"http://schema.org","@ty=
pe":"EmailMessage","action":{"@type":"ViewAction","name":"View Work item"=
,"url":"https://gitlab.com/gnutls/gnutls/-/work_items/1897#note_342421265=
9"}}</script>
</p>
</div>
</body>
</html>
----==_mimepart_6a221096e4f79_371946a01159ac--
--===============8360250217689686929==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Gnutls-devel mailing list
[email protected]
http://lists.gnupg.org/mailman/listinfo/gnutls-devel
--===============8360250217689686929==--