8000 Undefined shift in IPAddressOrRange · Issue #4893 · randombit/botan · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Undefined shift in IPAddressOrRange #4893

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
randombit opened this issue May 29, 2025 · 1 comment
Open

Undefined shift in IPAddressOrRange #4893

randombit opened this issue May 29, 2025 · 1 comment

Comments

@randombit
Copy link
Owner

OSS-Fuzz 420401644 just posting this publicly since it's not in a release

@arckoor can you take a look?

/src/botan/src/lib/x509/x509_ext.cpp:1324:62: runtime error: shift exponent 32 is too large for 32-bit type 'int'
	    #0 0x567f4e426b45 in Botan::Cert_Extension::IPAddressBlocks::IPAddressOrRange<(Botan::Cert_Extension::IPAddressBlocks::Version)16>::decode_from(Botan::BER_Decoder&) [botan/src/lib/x509/x509_ext.cpp:0](https://github.com/randombit/botan/blob/5fbcc7daa2be40fc662e48343882f7abc8827a94/src/lib/x509/x509_ext.cpp#L0)
	    #1 0x567f4e2d0640 in Botan::BER_Decoder::decode(Botan::ASN1_Object&, Botan::ASN1_Type, Botan::ASN1_Class) [botan/src/lib/asn1/ber_dec.cpp:371](https://github.com/randombit/botan/blob/5fbcc7daa2be40fc662e48343882f7abc8827a94/src/lib/asn1/ber_dec.cpp#L371):8

Hex encoding of the minimized test case

308201B830820162A003020102021020202020202020202020202020202020300D06092A864886F70D0101050500300D310B30090603202020B6022020301E170D3130303931313131313133375A170D3231303930313134343131395A300D310B300906032020201E022020305C300D0606FF202020202020202020200320002020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020A3819D30819A304906082B06010505070107043D303B302004030002203080030320202003032020200303FF20202003202020200320202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020FF300D06092A864886F70D010105050003410020202020202020202020FFFF20202020202020202020202020202020202020202020202020202020202020FF2020202020202020202020202020202020202020
@arckoor
Copy link
Contributor
arckoor commented May 29, 2025 •
edited
Loading

Ah, I see what's going on: we never assert that unused_bits is actually something sensible, so nothing is stopping someone from encoding a 32 or larger there and cause the above. Will address in #4890, along with something way more spicy I also found today.
Though I don't yet quite understand how it got to 32 in the first place, that should all be uint8_ts 🤔 Cpp does not, in fact, cast the 1 we shift with to a u8 at compile time like I assumed

@arckoor arckoor mentioned this issue Jun 14, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@randombit @arckoor
0