jplomas / liboqs / 29415874739

82%

Build Type

push

github

Committed by web-flow

Commit Message

Fix integer overflow in OQS_MEM_aligned_alloc size calculation (#2492)

Both the OpenSSL and fallback branches of OQS_MEM_aligned_alloc compute
size + offset with no overflow check before passing the result to the
underlying allocator. When size is near SIZE_MAX, this wraps to a small
value, so the allocator returns a real but far too small buffer while
the caller still treats the returned pointer as valid for the full
requested size. Add a guard before each allocation call that rejects
the request instead of letting the addition wrap.

Confirmed with ASan: before this change, an unaligned near-SIZE_MAX
size drives CRYPTO_malloc/malloc down to an 8-byte (OpenSSL branch) or
1-byte (fallback branch) allocation, and the pointer-alignment bookkeeping
inside OQS_MEM_aligned_alloc itself immediately writes past it
(heap-buffer-overflow at common.c:329 and common.c:386 respectively).
After the fix both cases return NULL cleanly.

Also adds the alignment/size validation that the fallback branch
already performs (power-of-two alignment >= sizeof(void*), size a
multiple of alignment) to the OpenSSL branch, which was missing it
entirely.

See GHSA-54w9-9rvw-3fg4 for the original report.

Signed-off-by: Vishnu Ajith <27vishnu07@gmail.com>

Coverage Stats

2 of 5 new or added lines in 1 file covered. (40.0%)

334 existing lines in 19 files now uncovered.

210535 of 255710 relevant lines covered (82.33%)

8134961.64 hits per line