Conversation

Charlotte 🦝 therian

another day another CVE caused by error handling being seen as optional by languages

3
8
17

Charlotte 🦝 therian

Edited 10 months ago

this time the price goes to

…go

congrats c you are free for the day!

2
1
6

@charlotte if i was the programmer i would simply have handled the error

0
0
0

it’s CVE-2023-1732 for those checking at home.

0
1
4

@charlotte as far as i can tell it's not a result of error handling. their error handling remains the same both before and after the fix. the issue is that they used rand.Read(...) instead of io.ReadFull(rand, ...), the latter not guaranteeing a full read into the provided byte buffer. so in cases of incomplete reads the entropy buffer could contain a bunch of zeroed data. it's the same cause of a CVE in the github.com/satori/go.uuid package

0
0
1

@teleportaura @charlotte I mean that's how the .Read() interface is designed and documented, and why it returns the number of bytes read

0
0
0