Fix integer overflow in wolfSSL_writev#9296
Closed
embhorn wants to merge 2 commits intowolfSSL:masterfrom
Closed
Conversation
Member
Author
|
Retest this please
|
dgarske
requested changes
Oct 14, 2025
| for (i = 0; i < iovcnt; i++) | ||
| sending += iov[i].iov_len; | ||
| for (i = 0; i < iovcnt; i++) { | ||
| if (!WC_SAFE_SUM_WORD32(sending, (word32)iov[i].iov_len, sending)) |
Member
There was a problem hiding this comment.
Looks good, but technically over 80 chars...
[check-source-text] [4 of 52] [c243f41193]
configure... real 0m11.105s user 0m5.781s sys 0m3.870s
[skipping "codespell" subtest in check-source-text -- codespell is missing or too old]
overlong lines added:
src/ssl.c:11582 if (!WC_SAFE_SUM_WORD32(sending, (word32)iov[i].iov_len, sending))
check-source-text OK
douzzer
requested changes
Oct 14, 2025
| for (i = 0; i < iovcnt; i++) | ||
| sending += iov[i].iov_len; | ||
| for (i = 0; i < iovcnt; i++) { | ||
| if (!WC_SAFE_SUM_WORD32(sending, (word32)iov[i].iov_len, sending)) |
Contributor
There was a problem hiding this comment.
whoops, there's still a defect here -- you can't blindly truncate .iov_len to word32. you have to check if it fits in a word32 before casting it. we should use size_t for accumulation, and implement WC_SAFE_SUM_SIZE_T().
Merged
Contributor
|
Closed in favor of #9298 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The total byte count is accumulated into a 32-bit
word32and used for allocation, while the copy loop uses the trueioveclengths. When the sum exceeds 32 bits, it wraps, under-allocating the buffer and causing an overflow in the subsequent copies.Fixes zd20646
Testing
Unused code, visually confirmed
Checklist