You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I reported this to [email protected] (per your explicit request to report potential security bugs there, I personally don't care), but they don't understand what I'm talking about.
The problem is that you don't perform the necessary casting:
Thank you for this report. This is not a security issue, which is probably why the people at [email protected]<mailto:[email protected]> didn’t know what to do.
Looking at the specs of the C language, I see that the byte value is promoted to an int, and the left shift by 24 of a byte value >= 128 makes the value larger than can be represented in a signed int, it would need an unsigned int. In fact, C only guarantees that int is 16 bits long, so this code is even more flawed.
The right fix will be to insert casts to UINT32; the shift operations are well-defined on unsigned 32-bit values.
I don’t think this is urgent, so I’ll fix it the next time I’m changing things.
Thanks again,
Niels
I reported this to [email protected] (per your explicit request to report potential security bugs there, I personally don't care), but they don't understand what I'm talking about.
The problem is that you don't perform the necessary casting:
SymCrypt/inc/symcrypt_internal.h
Line 524 in 263e3e6
The text was updated successfully, but these errors were encountered: