5227548397
68%
target-openssl: 68%

Ran 10 Jun 2023 02:39AM UTC

Jobs 1

Files 1355

Run time 21s

Badge

Embed ▾

Committed 19 May 2023 10:42AM UTC coverage: 68.058% (-0.001%) from 68.059%

Build # 5227548397

Build Type

push

github

Committed by

t8m

Commit Message

Update hkdf.c to avoid potentially vulnerable code pattern

The expression "if (a+b>c) a=c-b" is incorrect if "a+b" overflows.
It should be replaced by "if (a>c-b) a=c-b", which avoids the
potential overflow and is much easier to understand.

This pattern is the root cause of CVE-2022-37454, a buffer overflow
vulnerability in the "official" SHA-3 implementation.

It has been confirmed that the addition in
https://github.com/openssl/openssl/blob/master/providers/implementations/kdfs/hkdf.c#L534
cannot overflow. So this is only a minor change proposal to avoid
a potentially vulnerable code pattern and to improve readability.
More information: https://github.com/github/codeql/pull/12036#issuecomment-1466056959

CLA: trivial

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20990)

Run Details

172858 of 253986 relevant lines covered (68.06%)

2372115.74 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	5227548397.1	10 Jun 2023 02:39AM UTC	0	68.06	GitHub Action Run

Source Files on build 5227548397

Detailed source file information is not available for this build.

universal-ctags / target-openssl / 5227548397
68%
target-openssl: 68%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 5227548397

universal-ctags / target-openssl / 5227548397 68% target-openssl: 68%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 5227548397

universal-ctags / target-openssl / 5227548397
68%
target-openssl: 68%

README BADGES
x