From: Nakayama Kenjiro <nakayamakenjiro@gmail.com>
Subject: Re: [PATCH] libressl: Fix integer overflow
To: Theo Buehler <tb@theobuehler.org>
Cc: tech@openbsd.org
Date: Wed, 26 Feb 2025 19:16:52 +0900

Thank you.
Yes, the second ca->type was pointed out by CID: 497397.
I will include the CID next time. Sorry about that.


On Wed, Feb 26, 2025 at 6:59 PM Theo Buehler <tb@theobuehler.org> wrote:

> On Wed, Feb 26, 2025 at 06:02:02PM +0900, Kenjiro Nakayama wrote:
> > If the values a->length or ca->type is large, they could overflow,
> > which would cause undefined behavior.
>
> Committed, thanks.
>
> I had similar fixes for obj_dat.c in one of my trees, I think this was
> prompted by Coverity, but I don't remember for sure. If you did find it
> using Coverity, it would be nice to include the CID.
>


-- 
Kenjiro NAKAYAMA <nakayamakenjiro@gmail.com>
GPG Key fingerprint = ED8F 049D E67A 727D 9A44  8E25 F44B E208 C946 5EB9