From 879a55add9c933cb31b18d7bd7712dbf915e4036 Mon Sep 17 00:00:00 2001 From: Christopher Haster Date: Sun, 27 Apr 2025 14:33:25 -0500 Subject: [PATCH] Another ckparity flaw Found another ckparity flaw! Only detected now due to the reworked tag encoding, but it's just luck this wasn't detected earlier. Consider the following bit flip: 03 04 80 04 80 04 6b ... data w512 512 43 04 80 04 80 04 6b ... altble 0x304 w512 -512 ^ flip Not only are leb128s problem for ckparity, but even the difference in alt vs normal tag encoding presents a vulnerability. So limiting the ckparity tests further, to just 47 of the first 48 bits. --- tests/test_ck.toml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/tests/test_ck.toml b/tests/test_ck.toml index be60433f..64456d3e 100644 --- a/tests/test_ck.toml +++ b/tests/test_ck.toml @@ -2110,6 +2110,11 @@ code = ''' // to our revision count + first tag i < ((BADBIT == -1) ? 8*6 : 1); i++) { + // we can't even detect bit flips that change the + // alt vs tag encoding + if (BADBIT == -1 && i == 8*4+6) { + continue; + } lfs_size_t badbit = (BADBIT == -1) ? i : BADBIT; // reset the bd prng every run for reproducibility @@ -2262,6 +2267,11 @@ code = ''' // to our revision count + first tag i < ((BADBIT == -1) ? 8*6 : 1); i++) { + // we can't even detect bit flips that change the + // alt vs tag encoding + if (BADBIT == -1 && i == 8*4+6) { + continue; + } lfs_size_t badbit = (BADBIT == -1) ? i : BADBIT; // reset the bd prng every run for reproducibility