Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency on abandoned rust-crypto crate causes undefined behavior in sha256 hash #10

Open
riking opened this issue Feb 27, 2024 · 0 comments

Comments

@riking
Copy link

riking commented Feb 27, 2024

https://asan.saethlin.dev/ub?crate=rust-kpdb&version=0.5.0

test crypto::aes256::tests::test_decrypt_inverses_encrypt ... thread 'crypto::aes256::tests::test_decrypt_inverses_encrypt' panicked at 'attempted to leave type `u32` uninitialized, which is invalid', /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panicking.rs:126:5
stack backtrace:
   0: rust_begin_unwind
             at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/std/src/panicking.rs:617:5
   1: core::panicking::panic_nounwind_fmt
             at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panicking.rs:96:14
   2: core::panicking::panic_nounwind
             at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/panicking.rs:126:5
   3: core::mem::uninitialized
             at /root/.rustup/toolchains/nightly-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/library/core/src/mem/mod.rs:692:9
   4: crypto::cryptoutil::read_u32v_be
             at /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rust-crypto-0.2.36/src/cryptoutil.rs:132:32
   5: crypto::sha2::sha256_digest_block
             at /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rust-crypto-0.2.36/src/sha2.rs:354:5
   6: crypto::sha2::Engine256State::process_block
             at /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rust-crypto-0.2.36/src/sha2.rs:994:9
   7: crypto::sha2::Engine256::finish
             at /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rust-crypto-0.2.36/src/sha2.rs:1082:9
   8: <crypto::sha2::Sha256 as crypto::digest::Digest>::result
             at /root/.cargo/registry/src/index.crates.io-6f17d22bba15001f/rust-crypto-0.2.36/src/sha2.rs:1112:9
   9: kpdb::crypto::sha256::hash
             at ./src/crypto/sha256.rs:20:5

https://github.com/rustsec/advisory-db/blob/main/crates/rust-crypto/RUSTSEC-2016-0005.md

The ring crate provides a good implementation of SHA256.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant