Saturday, March 19, 2016

Apple's goto Fail Bug

static OSStatus
SSLVerifySignedServerKeyExchange(SSLContext *ctx, bool isRsa, SSLBuffer signedParams,uint8_t *signature, UInt16 signatureLen)
{
    OSStatus        err;
    ...
 
    if ((err = SSLHashSHA1.update(&hashCtx, &serverRandom)) != 0)
        goto fail;
    if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
        goto fail;
        goto fail; //code executes irrespective of whether if condition is    
        satisfied - always executes.
    if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
        goto fail;
    ...
 
fail:
    SSLFreeBuffer(&signedHashes);
    SSLFreeBuffer(&hashCtx);
    return err;
}

No comments:

Post a Comment

Full capabilities of ChatGPT 4 O (O for Omni) - From Openai.com

Omni, O, has multimodal capabitlies, which means it can take text, voice or video as an input and serve audio/text/image output (there's...