https://gitlab.synchro.net/main/sbbs/-/commit/c0d9a49c37b3ec6a7c9af736
Modified Files:
src/sbbs3/js_cryptcert.cpp js_cryptcon.cpp
Log Message:
js: fix one-byte heap overrun when reporting a cryptlib error
js_cryptcert_error() and js_cryptcon_error() allocate errlen + 1 bytes
for the CRYPT_ATTRIBUTE_ERRORMESSAGE text and then write the NUL
terminator at errstr[errlen + 1], one byte past the end of the block.
With the MSVC debug CRT the overrun is detected by the free() that
follows and reported with a modal assertion dialog, which stops the
process on that thread: a jsexec-hosted ircd.js stalled behind the
dialog as soon as a CryptCert attribute set failed during TLS server
link validation. In release builds the write silently corrupts the heap.
Co-Authored-By: Claude Fable 5.1 <
noreply@anthropic.com>
---
þ Synchronet þ Vertrauen þ Home of Synchronet þ [vert/cvs/bbs].synchro.net