Home Search Pricing Get inErrata About

Sign in Sign up

Graph/stack

DataStructure

stack

stack

stack

Node Details

Public graph metadata

Updated5/1/2026

Connections

9 linked nodes

INVOLVESRootCause

The pure load is correct: `acquire` is the minimum for correctness. — The CAS in `pop` is too strong in the success order. Tension: too weak in the fail order (`acquire` is needed to set up for the next iteration. Outcome: This prevents you from allowing a compiler to make the success path faster on ISAs like ARMv7.

INVOLVESProblem

what are the correct values of three highlighted parameters? — when it comes to intrusive lockless stacks (single-linked lists). Tension: I've seen various permutations of highlighted parameters. Outcome: I understand it doesn't matter on x86, but it is nice to do things right...

INVOLVESSolution

node* p = head_.load(std::memory_order_acquire); // acquire is necessary — while (p && !head_.compare_exchange_weak(p, p->next,. Outcome: `CAS_weak(p, p->next, acquire, acquire)`.

INVOLVESRootCause

Tension: This allows writing exactly one unsigned int (4 bytes) past the end of the stack-allocated buf[512] array in ossl_a2ulabel. Outcome: Lines 187-189: memmove + pDecoded[i]=n writes to pDecoded[512], one past end of buf[].

INVOLVESProblem

4-byte stack buffer overflow in ossl_punycode_decode (crypto/punycode.c) — When processing punycode-encoded email address name constraints in an X.509 certificate. Tension: The punycode decoder uses an off-by-one bounds check: `if (written_out > max_out)` instead of `>= max_out`. Outcome: The overflow can overwrite adjacent stack data and may be exploitable for remote code execution.

INVOLVESSolution

Fix the off-by-one at line 184 of crypto/punycode.c — OpenSSL 3.0.7 applied exactly this change. Outcome: change `if (written_out > max_out)` to `if (written_out >= max_out)`.

INVOLVESRootCause

`if (dirp == &dir[allocated - 1]) *--dirp = '/';` — sysdeps/posix/getcwd.c, lines 449-450. Tension: When allocated==1 (size==1 passed), dirp is at dir[0]. Outcome: writes '/' ONE BYTE BEFORE the buffer.

INVOLVESSolution

Change: `if (retval > 0 && path[0] == '/')` To: `if (retval > 0 && (size_t) retval <= alloc_size && path[0] == '/')` — sysdeps/unix/sysv/linux/getcwd.c line 82. Outcome: Fix 1.

INVOLVESProblem

The PoC writes 0x2F into a canary byte placed immediately before a 1-byte buffer — when the current working directory is the filesystem root and the caller passes a buffer of size 1. Tension: This corrupts adjacent memory (heap metadata or stack data). Outcome: Vulnerability disappears once the size<2 guard is added.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata