Closed
Bug 1804662
Opened 2 years ago
Closed 2 years ago
Assertion failure: (padsize == 0) || (pcount % padsize) == 0, at ../../lib/pkcs7/p7local.c:461
Categories
(NSS :: Libraries, defect)
Tracking
(firefox-esr102 wontfix, firefox109 wontfix, firefox110 wontfix, firefox111 wontfix, firefox112 fixed)
RESOLVED
FIXED
3.89
People
(Reporter: decoder, Assigned: jschanck)
References
Details
(Keywords: crash, sec-other, testcase, Whiteboard: [nss-triage][post-critsmash-triage][adv-main112-])
Attachments
(3 files)
The attached testcase crashes on nss revision a3669ed2c606+ (debug build with ASan/fuzzing).
For detailed crash information, see attachment.
To reproduce the issue, perform the following steps:
- Build NSS with fuzzing enabled and patch from bug 1804646 applied:
./build.sh --asan --clang --fuzz(assuming mozbuild clang/clang++ is on PATH and matching NSPR with ASan is installed/used). - Run
nssfuzz- test.bin
I don't think this is a security problem but keeping this hidden until all PKCS12 issues are resolved and the fuzzer itself is public.
|
Reporter | |
Comment 1•2 years ago
|
||
|
|
Reporter | |
Comment 2•2 years ago
|
||
|
||
Updated•2 years ago
|
Group: core-security → crypto-core-security
|
||
Comment 3•2 years ago
|
||
The severity field is not set for this bug.
:beurdouche, could you have a look please?
For more information, please visit auto_nag documentation.
Flags: needinfo?(bbeurdouche)
|
||
Updated•2 years ago
|
Flags: needinfo?(bbeurdouche)
Whiteboard: [nss-triage]
|
Assignee | |
Comment 4•2 years ago
|
||
Yeah that assertion shouldn't be there---it fires if the (untrusted) input is of the wrong length. It's safe to remove the assertion since the if block after it correctly returns an error. I think sec-other is fine since this only affects debug builds.
|
|
Assignee | |
Comment 5•2 years ago
|
||
|
||
Comment 6•2 years ago
|
||
Group: crypto-core-security → core-security-release
Status: NEW → RESOLVED
Closed: 2 years ago
status-firefox110:
--- → wontfix
status-firefox111:
--- → wontfix
status-firefox112:
--- → fixed
status-firefox-esr102:
--- → wontfix
Resolution: --- → FIXED
Target Milestone: --- → 3.89
|
|
||
Updated•2 years ago
|
Assignee: nobody → jschanck
|
||
Updated•2 years ago
|
Flags: qe-verify-
Whiteboard: [nss-triage] → [nss-triage][post-critsmash-triage]
|
||
Updated•2 years ago
|
Whiteboard: [nss-triage][post-critsmash-triage] → [nss-triage][post-critsmash-triage][adv-main112-]
|
||
Updated•2 years ago
|
Group: core-security-release
You need to log in
before you can comment on or make changes to this bug.
Description
•