[gnutls-devel] GnuTLS | gnutls_buffer_append_data: avoid use-after-free in the callers (!1399)
Read-only notification of GnuTLS library development activities
gnutls-devel at lists.gnutls.org
Tue Mar 9 18:27:30 CET 2021
Daiki Ueno commented on a discussion on lib/ext/key_share.c: https://gitlab.com/gnutls/gnutls/-/merge_requests/1399#note_525432181
> if (!have_creds_for_tls13(session))
> return 0;
> - /* write the total length later */
> - lengthp = &extdata->data[extdata->length];
Yes; there are several calls to `_gnutls_buffer_append*` between here and the place where the length is actually assigned, if `realloc` (called underneath) allocates a new memory, `lengthp` can be invalid.
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/-/merge_requests/1399#note_525432181
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Gnutls-devel