Your message dated Thu, 03 Mar 2016 21:05:43 +0000
with message-id <[email protected]>
and subject line Bug#773000: fixed in dumpasn1 20150808-1
has caused the Debian Bug report #773000,
regarding dumpasn1: slow on crafted input
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
773000: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773000
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: dumpasn1
Version: 20130608-1
Severity: minor
Usertags: afl
dumpasn1 is super slow while verifying this 5-bytes-long crafted input
file:
$ time dumpasn1 -s slow.der
0 warnings, 2 errors.
real 0m9.955s
user 0m2.644s
sys 0m7.252s
strace tells me that the program was busy reading the input file past
EOF:
read(3, "", 4096) = 0
read(3, "", 4096) = 0
read(3, "", 4096) = 0
[... and so on, literally millions times...]
This bug was found using American fuzzy lop:
https://packages.debian.org/experimental/afl
-- System Information:
Debian Release: 8.0
APT prefers unstable
APT policy: (990, 'unstable'), (500, 'experimental')
Architecture: i386 (x86_64)
Foreign Architectures: amd64
Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=C, LC_CTYPE=pl_PL.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages dumpasn1 depends on:
ii libc6 2.19-13
--
Jakub Wilk
slow.der
Description: application/pkix-cert
--- End Message ---
--- Begin Message ---
Source: dumpasn1
Source-Version: 20150808-1
We believe that the bug you reported is fixed in the latest version of
dumpasn1, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mathieu Malaterre <[email protected]> (supplier of updated dumpasn1 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Thu, 03 Mar 2016 21:32:36 +0100
Source: dumpasn1
Binary: dumpasn1
Architecture: source
Version: 20150808-1
Distribution: unstable
Urgency: medium
Maintainer: Mathieu Malaterre <[email protected]>
Changed-By: Mathieu Malaterre <[email protected]>
Description:
dumpasn1 - ASN.1 object dump program
Closes: 773000
Changes:
dumpasn1 (20150808-1) unstable; urgency=medium
.
* New upstream release: 20150808. Closes: #773000
* Remove patch applied upstream: d/p/fixprintf.patch
* Bump Std-Vers to 3.9.7, no changes needed
Checksums-Sha1:
be0e133000ab73b969d670a9adf2124373447c4d 1869 dumpasn1_20150808-1.dsc
8cbdcf548cdd7d7748e4ff1342db57f823e70dae 61698 dumpasn1_20150808.orig.tar.gz
78141a1475ac999a2f5417b357eeb16ece3d6de1 6084 dumpasn1_20150808-1.debian.tar.xz
Checksums-Sha256:
ef56739dadf792e65e55dd610bacb5eac23917a6d7afa09350f4fc5d0c1c7716 1869
dumpasn1_20150808-1.dsc
6119a9e218c6d7744419fda413c8ea850c272a83c1d1716a5cc6b87a63215594 61698
dumpasn1_20150808.orig.tar.gz
db52bef8383eb3c8b7de86ab187715e0edb08364bbc48147cce6a24c664eb632 6084
dumpasn1_20150808-1.debian.tar.xz
Files:
215851a9d4c81f20891bc932a509a56f 1869 utils optional dumpasn1_20150808-1.dsc
b827326d67a79e38116b80fa3e1a0ed3 61698 utils optional
dumpasn1_20150808.orig.tar.gz
02acfc5a1cd920933395198676f9a436 6084 utils optional
dumpasn1_20150808-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJW2KR7AAoJEAFx4YKK4JNFcC4P/24++8jYNB+ctH4JH/EJSIo5
SP1/21KqjKMMGXTXNGXQJli7kWKcXRmF1D+FxDigDUszekKwVtSVq2IneHUPJRMa
corMd0nX4iNVVcBioKoxB9IbKcOqr1uYSSa/m5F+d6CQDhWyLp4sWLeLZa6XSa80
qyg/RaHdwo/XDiGAbW4qq3mHcOiadIo1HfNRCJgskJ+4Dge8dkf3TxFHssnWg9vo
IfHO3DtolPGv6AlN/QVnv9xD+ZpJU9CULROz1xKxjhrUCJ8A67VOyKjrf6MH6L3u
YvAhLXJfnaSVvJY3Qq7NmZAWduseYLTO/aVAMho7/zkCKg9explq9xcXy7z9BbZQ
Fd/WMNTO4TFmY/LLsN9LFdrm5m0rRX3cYd0b6uY4Twsmj4rW710Q9UK0wT0Vc1S0
jvEHhRZV7tG70/R9d3VQ1pHhrD3Dl/I+klOvZN+Qb5XHattr053h6sfFkear5BRO
xEqHSF9N62zj6sD78/uRuEyEgOR3n9rGUCDUcEtrmoucjkrQ/xUNNn+fpOyMHagZ
lUGRyEFXsF/77B1npbS12R+NKyQNroL+EcGYSINaC69fmJXoHyCc0ZGalWj+hmwb
V7bRFHguSacAwyyzd6+0kcpoDBnu0yBxyl8pOg6lcH8HGqM2C6sUDdr3cfROVNqF
GBoPpWvuzBBN5yDUG9X2
=dwbC
-----END PGP SIGNATURE-----
--- End Message ---
