Another ckparity flaw
Found another ckparity flaw! Only detected now due to the reworked tag encoding, but it's just luck this wasn't detected earlier. Consider the following bit flip: 03 04 80 04 80 04 6b ... data w512 512 43 04 80 04 80 04 6b ... altble 0x304 w512 -512 ^ flip Not only are leb128s problem for ckparity, but even the difference in alt vs normal tag encoding presents a vulnerability. So limiting the ckparity tests further, to just 47 of the first 48 bits.
This commit is contained in:
@@ -2110,6 +2110,11 @@ code = '''
|
||||
// to our revision count + first tag
|
||||
i < ((BADBIT == -1) ? 8*6 : 1);
|
||||
i++) {
|
||||
// we can't even detect bit flips that change the
|
||||
// alt vs tag encoding
|
||||
if (BADBIT == -1 && i == 8*4+6) {
|
||||
continue;
|
||||
}
|
||||
lfs_size_t badbit = (BADBIT == -1) ? i : BADBIT;
|
||||
|
||||
// reset the bd prng every run for reproducibility
|
||||
@@ -2262,6 +2267,11 @@ code = '''
|
||||
// to our revision count + first tag
|
||||
i < ((BADBIT == -1) ? 8*6 : 1);
|
||||
i++) {
|
||||
// we can't even detect bit flips that change the
|
||||
// alt vs tag encoding
|
||||
if (BADBIT == -1 && i == 8*4+6) {
|
||||
continue;
|
||||
}
|
||||
lfs_size_t badbit = (BADBIT == -1) ? i : BADBIT;
|
||||
|
||||
// reset the bd prng every run for reproducibility
|
||||
|
||||
Reference in New Issue
Block a user