5139658353
68%
target-openssl: 68%

Ran 01 Jun 2023 03:03AM UTC

Jobs 1

Files 1355

Run time 20s

Badge

Embed ▾

Committed 01 Jun 2023 03:03AM UTC coverage: 68.058% (-0.001%) from 68.059%

Build # 5139658353

Build Type

push

github

Committed by

t8m

Commit Message

Update hkdf.c to avoid potentially vulnerable code pattern

The expression "if (a+b>c) a=c-b" is incorrect if "a+b" overflows.
It should be replaced by "if (a>c-b) a=c-b", which avoids the
potential overflow and is much easier to understand.

This pattern is the root cause of CVE-2022-37454, a buffer overflow
vulnerability in the "official" SHA-3 implementation.

It has been confirmed that the addition in
https://github.com/openssl/openssl/blob/master/providers/implementations/kdfs/hkdf.c#L534
cannot overflow. So this is only a minor change proposal to avoid
a potentially vulnerable code pattern and to improve readability.
More information: https://github.com/github/codeql/pull/12036#issuecomment-1466056959

CLA: trivial

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20990)

Run Details

172859 of 253986 relevant lines covered (68.06%)

2342458.58 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	5139658353.1	01 Jun 2023 03:03AM UTC	0	68.06	GitHub Action Run

Source Files on build 5139658353

Detailed source file information is not available for this build.

universal-ctags / target-openssl / 5139658353
68%
target-openssl: 68%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 5139658353

universal-ctags / target-openssl / 5139658353 68% target-openssl: 68%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 5139658353

universal-ctags / target-openssl / 5139658353
68%
target-openssl: 68%

README BADGES
x