DragonFlyBSD Kernel Audit
DF-0965 / run.log
← back to finding ↓ download raw
sizeof(twofish_ctx) = 4276 (l_key[40]=160B, s_key[4]=16B, mk_tab[4*256]=4096B, k_len)
[control] key_len_bits=256 (k_len=4): status=0x0 exited 0, k_len=4 (function OK)
[trigger] key_len_bits=640 (k_len=10): status=0x0 exited 0, k_len=10 (function accepted oversized key)
BUG CONFIRMED: ctx->k_len=10 > supported max(4). The
  function silently took the bad size, ran the OOB loop at
  twofish.c:435 (i=0..9), wrote past me_key[4]/mo_key[4]
  (stack) and s_key[4] (struct, into mk_tab), then gen_mk_tab
  at twofish.c:335 fell through (k_len not in {2,3,4}) leaving
  mk_tab as the OOB-written garbage.