Maniphest T8371

gcry_mpi_scan with GCRYPTMPI_FMT_SSH (rarely used), gcry_sexp_sscan OOB
Closed, ResolvedPublic
Actions

Assigned To
• gniibe
Authored By
• gniibe
Mon, Aug 3, 8:32 AM
Tags
Subscribers
• alexk
• gniibe
m.eik
• werner

Description

We received about several issues, we have two things to be fixed among them:

  • GCRYPTMPI_FMT_SSH
    • gcry_mpi_scan should validate the BUFLEN in case of GCRYPTMPI_FMT_SSH
  • Possible OOB read: gcry_sexp_sscan when input is quoted and include CRLF (or LFCR)
    • The check with n is wrong, should be n>1

Reported-by: zhangph (afldl)

Revisions and Commits

rC libgcrypt
rC1d97fc609e93 sexp:scan: Fix parsing quoted and CRLF/LFCR.
rC163569bff1f5 mpi:scan: Support BUFLEN check for GCRYMPI_FMT_SSH.

Related Objects

Event Timeline

• gniibe created this task.Mon, Aug 3, 8:32 AM
• gniibe lowered the priority of this task from Unbreak Now! to Normal.Wed, Aug 5, 7:17 AM
• gniibe edited projects, added libgcrypt; removed Security.
• gniibe updated the task description. (Show Details)Wed, Aug 5, 7:20 AM
• gniibe added a commit: rC163569bff1f5: mpi:scan: Support BUFLEN check for GCRYMPI_FMT_SSH..Wed, Aug 5, 7:20 AM
• gniibe updated the task description. (Show Details)Wed, Aug 5, 7:24 AM
• gniibe added a commit: rC1d97fc609e93: sexp:scan: Fix parsing quoted and CRLF/LFCR..Wed, Aug 5, 7:29 AM
• gniibe changed the task status from Open to Testing.Fri, Aug 7, 6:53 AM
• gniibe mentioned this in Unknown Object (Maniphest Task).Mon, Aug 10, 3:55 AM
• gniibe renamed this task from Reports from zhangph (afldl) to gcry_mpi_scan with GCRYPTMPI_FMT_SSH (rarely used), gcry_sexp_sscan OOB.Tue, Aug 11, 3:35 AM
• gniibe updated the task description. (Show Details)
• werner mentioned this in T8223: Release Libgcrypt 1.12.3.Wed, Aug 26, 10:40 AM
• werner closed this task as Resolved.Wed, Aug 26, 10:46 AM
• werner shifted this object from the Restricted Space space to the S1 Public space.
• werner changed the edit policy from "Custom Policy" to "Contributor (Project)".
• werner changed the visibility from "g10code (Project)" to "Public (No Login Required)".