"a buffer-length typo reduces a 2048-bit DH modulus to one byte" press 4 to doubt
0 Boosts
0 Likes
This federated comment is not yet available here.
@hipsterelectron FFS those clowns have their severities backwards. The one labeled medium is critical and the one labeled critical is medium-low.
@dalias i really don't like the phrasing "buffer length typo". that's a completely unserious thing to say
@hipsterelectron It really was. They mixed up sizeof(foo_g) with sizeof(foo_p).
@hipsterelectron to the article's author: "a typo? well, SHOW ME"
@jn so they do apparently but i adamantly refuse the snivelling language https://aus.social/@umbrella/117515231749479584
@hipsterelectron
- mbedtls_ssl_conf_dh_param_bin(conf, dhm_p, sizeof(dhm_g), dhm_g, sizeof(dhm_g))
+ mbedtls_ssl_conf_dh_param_bin(conf, dhm_p, sizeof(dhm_p), dhm_g, sizeof(dhm_g))
oh god, this needs a safety macro that puts the same name in the corresponding pointer/size parameters
@jn @hipsterelectron Yeah, a macro or a struct with both data and size.
