007bsd

Open source

Pull requests, issues and fixes credited to me across open-source projects.

Credited in fixes

Fixes by maintainers that credit my report or suggestion.

  1. CROSS: check signature length in crypto_sign_verify open-quantum-safe/liboqs “Bug reported by @007bsd”
  2. Adding key_usage check to CM_AES functions chipsalliance/caliptra-sw “Suggested by: @007bsd”
  3. runtime: Minor cleanup in AES-GCM DMA handler chipsalliance/caliptra-sw “Suggested by @007bsd”
  4. ascon: don't output plaintext if authentication fails cloudflare/circl “Originally reported by @007bsd”
  5. revise analyze2vips libvips/libvips “Thanks 007bsd!”
  6. Auth manifest metadata lookup should use entry_count chipsalliance/caliptra-sw “Credit to @007bsd for reporting this bug”

Pull requests

Changes I proposed upstream.

  1. crypto/http/http_client.c: fix busy-loop in OSSL_HTTP_proxy_connect on EOF openssl/openssl
  2. mlkem: add re-encryption comparison vectors to the seed-key files C2SP/wycheproof
  3. Add advisories for pqc_kyber and cosmian_kyber (AVX2 cmov skips FO implicit rejection, key recovery) rustsec/advisory-db
  4. Fix broken AVX2 cmov that skips FO implicit rejection (key recovery) Argyle-Software/kyber
  5. Fix broken AVX2 cmov that skips FO implicit rejection (key recovery) Cosmian/kyber
  6. quic: charge anti-amplification credit per packet, not per datagram openssl/openssl
  7. Fix memory leaks in X.509 policy and name-constraint handling openssl/openssl
  8. poly1305: prevent crash on final without a key openssl/openssl
  9. aes_wrap: prevent crash on update without a key openssl/openssl
  10. Add profile_fuzzer for raw EXIF/XMP/IPTC/ICC parsing ImageMagick/ImageMagick
  11. Fix function pointer type mismatch in MSBLOB/PVK key encoder openssl/openssl
  12. Fix unsound free of uninitialized pointers in GetImageFeatures error path ImageMagick/ImageMagick
  13. Fix function pointer type mismatch when freeing ML-KEM and ECX keys openssl/openssl

Issues

Bugs and design questions I reported in public.

  1. pkcs7: eight pk7_lib.c functions dereference absent OPTIONAL content, crashing openssl smime -resign openssl/openssl
  2. cmp: caPubs install in ossl_cmp_msg_check_update() is not gated on verified protection openssl/openssl
  3. OSSL_HTTP_get() forwards caller Authorization/Cookie headers to a cross-origin redirect target openssl/openssl
  4. Let a CMP client require EnvelopedData (reject EncryptedValue) for centrally generated keys openssl/openssl
  5. cms: EnvelopedData auth==0 arm accepts non-CBC content ciphers openssl/openssl
  6. do_create() in crypto/asn1/asn_moid.c reads below the input buffer when an oid_section entry has an all-whitespace long-name field openssl/openssl
  7. win32_joiner() in crypto/dso/dso_win32.c writes 1 byte past the allocation when the directory has no trailing separator and file is NULL openssl/openssl
  8. KEM recipient branch in CMS_decrypt_set1_pkey_and_peer does not apply the MMA/anti-oracle masking applied to the KTRI branch openssl/openssl
  9. getByText(/.../u) with `>>` in regex source produces an unparseable selector microsoft/playwright
  10. locator parser: unsafeLocatorOrSelectorAsSelector throws on malformed input; locatorOrSelectorAsSelector emits unparseable selectors microsoft/playwright
  11. PermissionRequest.action round-trip turns None into PermissionRequestMemoryAction.STORE github/copilot-sdk
  12. PermissionPromptRequest.action round-trip turns None into PermissionPromptRequestMemoryAction.STORE github/copilot-sdk
  13. SessionTaskCompleteData round-trip turns None summary into empty string github/copilot-sdk
  14. Python codegen: _compat_to_python_key / _compat_to_json_key are not inverses for keys with common abbreviations (URL, ID, IP, XML, OAuth) github/copilot-sdk
  15. cliUrl / cli_url parser rejects IPv6 addresses (including bracketed [::1]:port form) github/copilot-sdk
  16. page.route() silently aborts navigation when glob contains unbalanced { or } microsoft/playwright
  17. Invalid `|` usage in stringified type hints can crash or hang execution robotframework/robotframework
  18. Collections: `Get Index From List` does not handle negative start indices correctly robotframework/robotframework
  19. String: `Convert To Title Case` fails with bad error message if `exclude` contains invalid regexp robotframework/robotframework
  20. String: Bad error reporting when automatic bytes conversion fails robotframework/robotframework

Full activity on github.com/007bsd.