On Mon, Apr 28, 2014 at 09:51:12PM +0200, Jakub Hrozek wrote:
On Thu, Apr 17, 2014 at 08:57:54AM +0200, Lukas Slebodnik wrote:
> The size of output buffer(obufsize) was longer than initialised data.
> In calculation, uint32_t was used for length of the cryptotext,
> but uint16_t was written into buffer. The end of buffer was not initialised
> and it caused valgrind warning.
> Use of uninitialised value of size 8
> at 0x37AE40F363: pl_base64_encode_buffer (nssb64e.c:180)
> by 0x37AE40F6ED: NSSBase64_EncodeItem_Util (nssb64e.c:482)
> by 0x37AE40F87A: BTOA_DataToAscii_Util (nssb64e.c:721)
> by 0x40208A: sss_base64_encode (nss_base64.c:47)
> by 0x403305: sss_password_encrypt (nss_obfuscate.c:358)
> The easiest reproducer is the crypto-test.
> CK_FORK=no libtool --mode=execute valgrind ./crypto-tests
Very nice catch.
Both online and offline authentication still work and the warning is
Pushed to master: 9faab6d48145d3a0d7b9a225ed35bdcaa32eca2c