Skip to content

Commit

Permalink
Fix CVE-2022-3602 in punycode decoder.
Browse files Browse the repository at this point in the history 
An off by one error in the punycode decoder allowed for a single unsigned int
overwrite of a buffer which could cause a crash and possible code execution.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
  • Loading branch information
@paulidale @t8m
paulidale authored and t8m committed Nov 1, 2022
1 parent 4bae06d commit fe3b639
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion crypto/punycode.c
View file
Expand Up @@ -181,7 +181,7 @@ int ossl_punycode_decode(const char *pEncoded, const size_t enc_len,
n = n + i / (written_out + 1);
i %= (written_out + 1);

if (written_out > max_out)
if (written_out >= max_out)
return 0;

memmove(pDecoded + i + 1, pDecoded + i,
Expand Down

17 comments on commit fe3b639

@ItzSwirlz
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one byte.

one

@EliteUn17y
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

funny byte

@jae1911
Copy link

@jae1911 jae1911 commented on fe3b639 Nov 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security by trolling.

@NotNite
Copy link

@NotNite NotNite commented on fe3b639 Nov 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lmfao

@fnbf
Copy link

@fnbf fnbf commented on fe3b639 Nov 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Took a byte out of crime.

@blueforesticarus
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rewrite it in rust

@seano-vs
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This will make me double check every </> for the foreseeable future

@makindotcc
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

essa

@DMessham
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

one "=" is all it was?

@ericcurtin
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

rewrite it in rust

Read my mind https://twitter.com/ericcurtin17/status/1585918984914075648

@Vap0r1ze
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

she written on my >==== till i max_out

@owocean
Copy link

@owocean owocean commented on fe3b639 Nov 1, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

most underwhelming vulnerability ever

@Saghetti0
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cannot believe that this single-handedly caused a critical cve

@CloudburstSys
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

entire security industry has been collectively anxious about this vulrnability for it to turn out that the root cause was a single byte

@ericcurtin
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cannot believe that this single-handedly caused a critical cve

it got downgraded to high in the end

@ItzSwirlz
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cannot believe that this single-handedly caused a critical cve

it got downgraded to high in the end

Rather be over prepared than underprepared.

@iamvolvo
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is so punny 😄

Please sign in to comment.