5233085217
68%
target-openssl: 68%

Ran 11 Jun 2023 02:56AM UTC

Jobs 1

Files 1355

Run time 17s

Badge

Embed ▾

Committed 11 Jun 2023 02:56AM UTC coverage: 68.058%. Remained the same

Build # 5233085217

Build Type

push

github

Committed by

t8m

Commit Message

Update hkdf.c to avoid potentially vulnerable code pattern

The expression "if (a+b>c) a=c-b" is incorrect if "a+b" overflows.
It should be replaced by "if (a>c-b) a=c-b", which avoids the
potential overflow and is much easier to understand.

This pattern is the root cause of CVE-2022-37454, a buffer overflow
vulnerability in the "official" SHA-3 implementation.

It has been confirmed that the addition in
https://github.com/openssl/openssl/blob/master/providers/implementations/kdfs/hkdf.c#L534
cannot overflow. So this is only a minor change proposal to avoid
a potentially vulnerable code pattern and to improve readability.
More information: https://github.com/github/codeql/pull/12036#issuecomment-1466056959

CLA: trivial

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20990)

Run Details

172858 of 253986 relevant lines covered (68.06%)

2386559.43 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	5233085217.1	11 Jun 2023 02:56AM UTC	0	68.06	GitHub Action Run

Source Files on build 5233085217

Detailed source file information is not available for this build.

universal-ctags / target-openssl / 5233085217
68%
target-openssl: 68%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 5233085217

universal-ctags / target-openssl / 5233085217 68% target-openssl: 68%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 5233085217

universal-ctags / target-openssl / 5233085217
68%
target-openssl: 68%

README BADGES
x