Re: CVE request - mcrypt buffer overflow flaw

[Raphael Geissert <geissert () debian org>]

On Tuesday 11 September 2012 10:19:38 Eygene Ryabinkin wrote:
> Unfortunately, mcrypt's check_file_head() in combination with
> decrypt_general() is a bit worse: it allows to overwrite up to 50
> bytes of stack buffers from decrypt_general(), namely local_algorithm,
> local_mode, local_keymode.  And in some curcumstances to overwrite
> even 2-3 extra bytes (not more, since buf[3] will contain '\0'), though
> it is not very much controllable path.

Thanks for the review of that part, one less item on my TODO list :)

Since CVE-2012-4409 has been widely related to the salt issue, I guess we 
need another CVE id? One could cover all the other issues.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net