Home Search Pricing Get inErrata About

Sign in Sign up

Graph/openssl

Component

openssl

openssl

openssl

Node Details

Public graph metadata

Updated5/1/2026

Connections

21 linked nodes

WRITTEN_INLanguage

RELATES_TODomain

RELATES_TODomain

Security Theater

AFFECTSRootCause

Tension: This allows writing exactly one unsigned int (4 bytes) past the end of the stack-allocated buf[512] array in ossl_a2ulabel. Outcome: Lines 187-189: memmove + pDecoded[i]=n writes to pDecoded[512], one past end of buf[].

AFFECTSRootCause

the sm2_plaintext_size() function in crypto/sm2/sm2_crypt.c computes the required output buffer size using a FIXED overhead formula — ASN.1 INTEGER encoding of the EC point coordinates (C1x and C1y BIGNUMs). Tension: This is WRONG because the ASN.1 INTEGER encoding of the EC point coordinates (C1x and C1y BIGNUMs) can be SHORTER than field_size bytes. Outcome: An attacker who crafts a malicious ciphertext with intentionally small C1x/C1y INTEGER values (few bytes) but a very large C2 (payload) field will cause sm2_plaintext_size to return a buffer size smaller than the actual decoded C2->length.

AFFECTSRootCause

The vulnerable check is 'if (written_out > max_out) return 0;' which should be 'if (written_out >= max_out) return 0;' — crypto/punycode.c at line 184. Tension: When written_out equals max_out (512), the condition is false, allowing the loop to continue. Outcome: The loop then executes lines 187-191 which write to pDecoded[written_out], overflowing by 4 bytes.

AFFECTSRootCause

incorrectly checks bits of 'p' instead of 'p-1' — The code attempts to factor p-1 as 2^e*q where q is odd. Tension: With a crafted prime where consecutive bit positions are 0, the while loop never finds a set bit. Outcome: iterates indefinitely.

AFFECTSRootCause

Read tls1_process_heartbeat (t1_lib.c lines 2554-2620). Outcome: Identical pattern in dtls1_process_heartbeat in ssl/d1_both.c lines 1455-1519.

AFFECTSRootCause

the main Tonelli–Shanks loop (`while (1)` starting around line 286 of bn_sqrt.c) can fail to terminate — When p is composite. Tension: its only exits are BN_is_one(b) success or the inner `if (i == e)` not-a-square error.

AFFECTSRootCause

trusts the 16-bit payload length field from the attacker-supplied heartbeat message without verifying that this length is consistent with the actual length of the received TLS record — The function tls1_process_heartbeat in ssl/t1_lib.c. Tension: without verifying that this length is consistent with the actual length of the received TLS record (s->s3->rrec.length). Outcome: It then memcpy's `payload` bytes from the record data into a response buffer that is sent back to the peer.

AFFECTSSolution

Add a length validation check before the memcpy operation — around line 2565. Tension: This ensures memcpy on line 2586 cannot read beyond the actual heartbeat message boundaries. Outcome: if (payload > s->s3->rrec.length - 3) { SSLerr(...); return 0; }.

PERTAIN_TOSolution

Two fixes needed:. Outcome: The official patch in OpenSSL 1.1.1l does both: sm2_plaintext_size was changed to parse the input DER and use the actual C2 length.

PERTAIN_TOSolution

Fix the off-by-one at line 184 of crypto/punycode.c — OpenSSL 3.0.7 applied exactly this change. Outcome: change `if (written_out > max_out)` to `if (written_out >= max_out)`.

PERTAIN_TOProblem

reads a 2-byte attacker-controlled `payload` length from the incoming TLS record, then calls memcpy(bp, pl, payload) — OpenSSL CVE-2014-0160 (Heartbleed). Tension: the TLS heartbeat request handler reads a 2-byte attacker-controlled `payload` length from the incoming TLS record. Outcome: to echo it ba.

PERTAIN_TOSolution

Outcome: Identical pattern in dtls1_process_heartbeat in ssl/d1_both.c lines 1455-1519.

PERTAIN_TOSolution

Add a length validation check before the memcpy operation — around line 2565. Tension: This ensures memcpy on line 2586 cannot read beyond the actual heartbeat message boundaries. Outcome: if (payload > s->s3->rrec.length - 3) { SSLerr(...); return 0; }.

PERTAIN_TOProblem

stack buffer overflow vulnerability in OpenSSL 3.0.0-3.0.6 — when processing X.509 certificates with name constraints containing punycode-encoded email address domain names. Tension: allows writing past the end of a 512-element stack-allocated buffer. Outcome: The vulnerability is triggered when a certificate's name constraint contains a punycode domain label that decodes to 512+ Unicode codepoints.

OCCURS_ONProblem

reads a 2-byte attacker-controlled `payload` length from the incoming TLS record, then calls memcpy(bp, pl, payload) — OpenSSL CVE-2014-0160 (Heartbleed). Tension: the TLS heartbeat request handler reads a 2-byte attacker-controlled `payload` length from the incoming TLS record. Outcome: to echo it ba.

PROVIDED_BYPackage

IMPLEMENTATION_OFDomain

IMPLEMENTATION_OFDomain

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata