5565345765
68%
target-openssl: 68%

Ran 16 Jul 2023 03:04AM UTC

Jobs 1

Files 1355

Run time 17s

Badge

Embed ▾

Committed 19 May 2023 10:42AM UTC coverage: 68.057% (-0.001%) from 68.058%

Build # 5565345765

Build Type

push

github

Committed by

t8m

Commit Message

Update hkdf.c to avoid potentially vulnerable code pattern

The expression "if (a+b>c) a=c-b" is incorrect if "a+b" overflows.
It should be replaced by "if (a>c-b) a=c-b", which avoids the
potential overflow and is much easier to understand.

This pattern is the root cause of CVE-2022-37454, a buffer overflow
vulnerability in the "official" SHA-3 implementation.

It has been confirmed that the addition in
https://github.com/openssl/openssl/blob/master/providers/implementations/kdfs/hkdf.c#L534
cannot overflow. So this is only a minor change proposal to avoid
a potentially vulnerable code pattern and to improve readability.
More information: https://github.com/github/codeql/pull/12036#issuecomment-1466056959

CLA: trivial

Reviewed-by: Paul Dale <pauli@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20990)

Run Details

172855 of 253986 relevant lines covered (68.06%)

2413220.49 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	5565345765.1	16 Jul 2023 03:04AM UTC	1355	68.06	GitHub Action Run

universal-ctags / target-openssl / 5565345765
68%
target-openssl: 68%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 5565345765

universal-ctags / target-openssl / 5565345765 68% target-openssl: 68%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 5565345765

universal-ctags / target-openssl / 5565345765
68%
target-openssl: 68%

README BADGES
x