Change Details

Reported by: Francisco Tacliad ------------- Severity: Low CWE: CWE-401 (Missing Release of Memory after Effective Lifetime) Location: src/asn1-func.c, do_expand_tree(), line 1145 Trigger: Crafted binary input to _ksba_derdn_to_str() This is a SEPARATE finding from Finding 1, triggered through a different code path (DER-to-string conversion, not string-to-DER). When do_expand_tree() processes certain crafted ASN.1 structures, allocated tree nodes are not freed on the error path. The fuzzer found one input (starting with "C=" followed by binary data) that leaks 556 bytes across 10 allocations per invocation. LeakSanitizer trace: Indirect leak of 176 byte(s) in 2 object(s) allocated from: #0 malloc #1 _ksba_malloc src/util.c:130:10 #2 _ksba_xmalloc src/util.c:238:13 #3 do_expand_tree src/asn1-func.c:1145:15 #4 do_expand_tree src/asn1-func.c:1208:14 (recursive) ... #8 decoder_init src/ber-decoder.c:809:13 #9 create_and_run_decoder src/dn.c:612:9 #10 _ksba_derdn_to_str src/dn.c:639:9 Impact: In a long-running process (gpg-agent, dirmngr), repeated processing of crafted certificates could gradually exhaust memory. Reproducer: Available on request (33-byte binary input).

Reported by: Francisco Tacliad -------------- Severity: Low CWE: CWE-401 (Missing Release of Memory after Effective Lifetime) Location: src/asn1-func.c, do_expand_tree(), line 1145 Trigger: Crafted binary input to _ksba_derdn_to_str() This is a SEPARATE finding from Finding 1, triggered through a different code path (DER-to-string conversion, not string-to-DER). When do_expand_tree() processes certain crafted ASN.1 structures, allocated tree nodes are not freed on the error path. The fuzzer found one input (starting with "C=" followed by binary data) that leaks 556 bytes across 10 allocations per invocation. LeakSanitizer trace: Indirect leak of 176 byte(s) in 2 object(s) allocated from: #0 malloc #1 _ksba_malloc src/util.c:130:10 #2 _ksba_xmalloc src/util.c:238:13 #3 do_expand_tree src/asn1-func.c:1145:15 #4 do_expand_tree src/asn1-func.c:1208:14 (recursive) ... #8 decoder_init src/ber-decoder.c:809:13 #9 create_and_run_decoder src/dn.c:612:9 #10 _ksba_derdn_to_str src/dn.c:639:9 Impact: In a long-running process (gpg-agent, dirmngr), repeated processing of crafted certificates could gradually exhaust memory. Reproducer: Available on request (33-byte binary input).

Reported by: Francisco Tacliad -------------- Severity: Low CWE: CWE-401 (Missing Release of Memory after Effective Lifetime) Location: src/asn1-func.c, do_expand_tree(), line 1145 Trigger: Crafted binary input to _ksba_derdn_to_str() This is a SEPARATE finding from Finding 1, triggered through a different code path (DER-to-string conversion, not string-to-DER). When do_expand_tree() processes certain crafted ASN.1 structures, allocated tree nodes are not freed on the error path. The fuzzer found one input (starting with "C=" followed by binary data) that leaks 556 bytes across 10 allocations per invocation. LeakSanitizer trace: Indirect leak of 176 byte(s) in 2 object(s) allocated from: #0 malloc #1 _ksba_malloc src/util.c:130:10 #2 _ksba_xmalloc src/util.c:238:13 #3 do_expand_tree src/asn1-func.c:1145:15 #4 do_expand_tree src/asn1-func.c:1208:14 (recursive) ... #8 decoder_init src/ber-decoder.c:809:13 #9 create_and_run_decoder src/dn.c:612:9 #10 _ksba_derdn_to_str src/dn.c:639:9 Impact: In a long-running process (gpg-agent, dirmngr), repeated processing of crafted certificates could gradually exhaust memory. Reproducer: Available on request (33-byte binary input).