Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add check for usage of Rat.SetString in math/big with an overflow error #819

Merged
merged 2 commits into from Jun 2, 2022
Merged

Add check for usage of Rat.SetString in math/big with an overflow error #819

merged 2 commits into from Jun 2, 2022

Conversation

hackallcode
Copy link
Contributor

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7
has an overflow that can lead to Uncontrolled Memory Consumption.

It is the CVE-2022-23772.

Fix of #810

Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7
has an overflow that can lead to Uncontrolled Memory Consumption.

It is the CVE-2022-23772.
Copy link
Member

@ccojocar ccojocar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks good, please could you use the helper function instead to check the call as mentioned in the comment. Thanks

rules/math_big_rat.go Outdated Show resolved Hide resolved
@codecov-commenter
Copy link

Codecov Report

Merging #819 (847b188) into master (fb587c1) will decrease coverage by 0.01%.
The diff coverage is 73.17%.

@@            Coverage Diff             @@
##           master     #819      +/-   ##
==========================================
- Coverage   74.37%   74.35%   -0.02%     
==========================================
  Files          49       50       +1     
  Lines        3091     3124      +33     
==========================================
+ Hits         2299     2323      +24     
- Misses        727      735       +8     
- Partials       65       66       +1     
Impacted Files Coverage Δ
helpers.go 43.14% <0.00%> (-0.89%) ⬇️
call_list.go 92.59% <80.00%> (+0.43%) ⬆️
rules/math_big_rat.go 86.95% <86.95%> (ø)
issue.go 76.92% <100.00%> (ø)
rules/rulelist.go 100.00% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fb587c1...847b188. Read the comment docs.

@ccojocar ccojocar merged commit 9c19cb6 into securego:master Jun 2, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants