search

dimxy / komodo

Komodo
https://komodoplatform.com/
Other
7 stars 4 forks source link

tokel: buffer overflow in fingerprint for new secp256k1hash #114

Closed dimxy closed 2 years ago

dimxy commented 2 years ago

On linux tokeld crashed when a cc spk with secp256k1hash is spent. the reason was buffer overflow due to insufficient fingerprint buffer space: for secp256k1hash fingerprint.buf was allocated of 20b size: https://github.com/dimxy/komodo/blob/d0260e8cb20057593be195b2f37614a3d6ca7335/src/cryptoconditions/src/cryptoconditions.c#L182 but in anonFingerprint() function it was overwritten by 32b array.

dimxy commented 2 years ago

the fix was made to alloc choice->fingerprint.buf always of 32b cleared with calloc (even if secp256k1hash fingerprint size is 20) (see dimxy/komodo repo tokel-s6 branch and TokelPlatform/tokel tokel branch)