1605922 - mp_toradix buffer overflow (write)

Status: RESOLVED FIXED

(NSS :: Libraries, defect, P3)

Description

[Guido Vranken]

Attachment: poc_mp_toradix.c

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0

Steps to reproduce:

Compile and run attached proof of concept.
Optionally compile NSS + PoC with AddressSanitizer.

Found with Cryptofuzz.
Use of mp_toradix appears very limited within NSS. Marking as security in case third-party dependencies upon NSS are affected.

Actual results:

Buffer overflow (write, 1 byte) in mp_toradix() with an output buffer the size suggested by mp_radix_size()

Expected results:

No buffer overflow

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jcj, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[BugBot [:suhaib / :marco/ :calixte]]

The priority flag is not set for this bug.
:jcj, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 3

[J.C. Jones [:jcj] (he/they)]

Confirmed. This might take a bit of time to get to, but thank you for the report!

Comment 4

[Guido Vranken]

You're welcome :).

Comment 5

[Kevin Jacobs [:kjacobs]]

Attachment: Bug 1605922 - Account for negative sign in mp_radix_size

Comment 6

[Kevin Jacobs [:kjacobs]]

Thanks for the report.

There isn't any exposure for Firefox where mp_radix_size is unused, but this is a tricky corner case and a good catch (since in most cases the size will be overestimated, leaving sufficient room).

Comment 7

[Kevin Jacobs [:kjacobs]]

https://hg.mozilla.org/projects/nss/rev/b64436ecbd796ce9912718f2efd01b650faba30f