Closed Bug 2046136 Opened 4 months ago Closed 4 months ago

Minor AI suggestions for hardening the CMS decoder

Categories

(NSS :: Libraries, defect, P3)

Product:
NSS
Component:
Libraries
Type:
defect

Tracking

(nss 3.126, firefox-esr115 wontfix, firefox-esr140 wontfix, firefox152 wontfix, firefox153 wontfix, firefox154 fixed)

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
nss --- 3.126
firefox-esr115 --- wontfix
firefox-esr140 --- wontfix
firefox152 --- wontfix
firefox153 --- wontfix
firefox154 --- fixed

People

(Reporter: KaiE, Unassigned)

Details

(Keywords: ai-involved, sec-want, Whiteboard: [adv-main154-])

Attachments

(1 external file)

An AI review of the CMS decoder code suggested minor hardening changes, on top of what was discovered in bug 2046134:

  • cmsdecode.c:692 — buf[0] is read before any len > 0 check in NSS_CMSDecoder_Update (the MS-Kerberos missing-SEQUENCE workaround). Reachable only on a child SignedData decoder's
    first update, which always carries len > 0, so practically unreachable; a 1-byte OOB read at worst. Add len > 0 && as the first conjunct.
  • cmsdigest.c:228 — digests[i] = NULL executes even when the preceding arena allocation failed (digests == NULL), a null-page write on OOM. DoS-only; guard with if (digests).
Keywords: ai-involved
Keywords: sec-want
Severity: -- → S3
Priority: -- → P3
Attached file (secure) —

If you accept the patch without requests for changes, please feel free to commit immediately.

I haven't yet checked clang-format

Pushed by kaie@kuix.de:
https://hg.mozilla.org/projects/nss/rev/c91a293e5518
Add a few sanity checks in CMS decoder. r=nss-reviewers,keeler

Status: NEW → RESOLVED
Closed: 4 months ago
Resolution: --- → FIXED
Group: crypto-core-security → core-security-release
Whiteboard: [adv-main154-]
Group: core-security-release
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: