mirror of
https://github.com/openssl/openssl.git
synced 2025-01-24 13:55:42 +08:00
56a51b5a1e
The expression "if (a+b>c) a=c-b" is incorrect if "a+b" overflows. It should be replaced by "if (a>c-b) a=c-b", which avoids the potential overflow and is much easier to understand. This pattern is the root cause of CVE-2022-37454, a buffer overflow vulnerability in the "official" SHA-3 implementation. It has been confirmed that the addition in https://github.com/openssl/openssl/blob/master/providers/implementations/kdfs/hkdf.c#L534 cannot overflow. So this is only a minor change proposal to avoid a potentially vulnerable code pattern and to improve readability. More information: https://github.com/github/codeql/pull/12036#issuecomment-1466056959 CLA: trivial Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/20990) |
||
|---|---|---|
| .. | ||
| common | ||
| fips | ||
| implementations | ||
| baseprov.c | ||
| build.info | ||
| decoders.inc | ||
| defltprov.c | ||
| encoders.inc | ||
| fips-sources.checksums | ||
| fips.checksum | ||
| fips.module.sources | ||
| legacyprov.c | ||
| nullprov.c | ||
| prov_running.c | ||
| stores.inc | ||