https://bugs.exim.org/show_bug.cgi?id=2643
--- Comment #5 from Simon Arlott <[email protected]> --- You're not terminating the string before calling BH_hex2bn(): ==34241== Memcheck, a memory error detector ==34241== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al. ==34241== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info ==34241== Command: ./a.out -cCs FFFFFFFF\ FFFFFFFF\ ADF85458\ A2BB4A9A\ AFDC5620\ 273D3CF1 ==34241== \ \ \ \ D8B9C583\ CE2D3695\ A9E13641\ 146433FB\ CC939DCE\ 249B3EF9 ==34241== \ \ \ \ 7D2FE363\ 630C75D8\ F681B202\ AEC4617A\ D3DF1ED5\ D5FD6561 ==34241== \ \ \ \ 2433F51F\ 5F066ED0\ 85636555\ 3DED1AF3\ B557135E\ 7F57C935 ==34241== \ \ \ \ 984F0C70\ E0E68B77\ E2A689DA\ F3EFE872\ 1DF158A1\ 36ADE735 ==34241== \ \ \ \ 30ACCA4F\ 483A797A\ BC0AB182\ B324FB61\ D108A94B\ B2C8E3FB ==34241== \ \ \ \ B96ADAB7\ 60D7F468\ 1D4F42A3\ DE394DF4\ AE56EDE7\ 6372BB19 ==34241== \ \ \ \ 0B07A7C8\ EE0A6D70\ 9E02FCE1\ CDF7E2EC\ C03404CD\ 28342F61 ==34241== \ \ \ \ 9172FE9C\ E98583FF\ 8E4F1232\ EEF28183\ C3FE3B1B\ 4C6FAD73 ==34241== \ \ \ \ 3BB5FCBC\ 2EC22005\ C58EF183\ 7D1683B2\ C6F34A26\ C1B2EFFA ==34241== \ \ \ \ 886B4238\ 61285C97\ FFFFFFFF\ FFFFFFFF 2 7FFFFFFF\ FFFFFFFF\ D6FC2A2C\ 515DA54D\ 57EE2B10\ 139E9E78 ==34241== \ \ \ \ EC5CE2C1\ E7169B4A\ D4F09B20\ 8A3219FD\ E649CEE7\ 124D9F7C ==34241== \ \ \ \ BE97F1B1\ B1863AEC\ 7B40D901\ 576230BD\ 69EF8F6A\ EAFEB2B0 ==34241== \ \ \ \ 9219FA8F\ AF833768\ 42B1B2AA\ 9EF68D79\ DAAB89AF\ 3FABE49A ==34241== \ \ \ \ CC278638\ 707345BB\ F15344ED\ 79F7F439\ 0EF8AC50\ 9B56F39A ==34241== \ \ \ \ 98566527\ A41D3CBD\ 5E0558C1\ 59927DB0\ E88454A5\ D96471FD ==34241== \ \ \ \ DCB56D5B\ B06BFA34\ 0EA7A151\ EF1CA6FA\ 572B76F3\ B1B95D8C ==34241== \ \ \ \ 8583D3E4\ 770536B8\ 4F017E70\ E6FBF176\ 601A0266\ 941A17B0 ==34241== \ \ \ \ C8B97F4E\ 74C2C1FF\ C7278919\ 777940C1\ E1FF1D8D\ A637D6B9 ==34241== \ \ \ \ 9DDAFE5E\ 17611002\ E2C778C1\ BE8B41D9\ 6379A513\ 60D977FD ==34241== \ \ \ \ 4435A11C\ 30942E4B\ FFFFFFFF\ FFFFFFFF ==34241== ==34241== Conditional jump or move depends on uninitialised value(s) ==34241== at 0x4F22FF5: ??? (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x4EFF14A: BN_hex2bn (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x1092CA: bn_from_text (in /home/simon/src/exim/src/util/a.out) ==34241== by 0x1096B6: main (in /home/simon/src/exim/src/util/a.out) ==34241== ==34241== Use of uninitialised value of size 8 ==34241== at 0x4F23001: ??? (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x4EFF14A: BN_hex2bn (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x1092CA: bn_from_text (in /home/simon/src/exim/src/util/a.out) ==34241== by 0x1096B6: main (in /home/simon/src/exim/src/util/a.out) ==34241== ==34241== Invalid read of size 1 ==34241== at 0x4EFF2FD: BN_hex2bn (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x1092CA: bn_from_text (in /home/simon/src/exim/src/util/a.out) ==34241== by 0x1096CD: main (in /home/simon/src/exim/src/util/a.out) ==34241== Address 0x5b1b491 is 0 bytes after a block of size 1 alloc'd ==34241== at 0x4C2FB0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so) ==34241== by 0x10920E: bn_from_text (in /home/simon/src/exim/src/util/a.out) ==34241== by 0x1096CD: main (in /home/simon/src/exim/src/util/a.out) ==34241== ==34241== Conditional jump or move depends on uninitialised value(s) ==34241== at 0x4F22FF5: ??? (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x4EFF14A: BN_hex2bn (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x1092CA: bn_from_text (in /home/simon/src/exim/src/util/a.out) ==34241== by 0x1096EA: main (in /home/simon/src/exim/src/util/a.out) ==34241== ==34241== Use of uninitialised value of size 8 ==34241== at 0x4F23001: ??? (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x4EFF14A: BN_hex2bn (in /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1) ==34241== by 0x1092CA: bn_from_text (in /home/simon/src/exim/src/util/a.out) ==34241== by 0x1096EA: main (in /home/simon/src/exim/src/util/a.out) ==34241== p = FFFFFFFFFFFFFFFFADF85458A2BB4A9AAFDC5620273D3CF1D8B9C583CE2D3695A9E13641146433FBCC939DCE249B3EF97D2FE363630C75D8F681B202AEC4617AD3DF1ED5D5FD65612433F51F5F066ED0856365553DED1AF3B557135E7F57C935984F0C70E0E68B77E2A689DAF3EFE8721DF158A136ADE73530ACCA4F483A797ABC0AB182B324FB61D108A94BB2C8E3FBB96ADAB760D7F4681D4F42A3DE394DF4AE56EDE76372BB190B07A7C8EE0A6D709E02FCE1CDF7E2ECC03404CD28342F619172FE9CE98583FF8E4F1232EEF28183C3FE3B1B4C6FAD733BB5FCBC2EC22005C58EF1837D1683B2C6F34A26C1B2EFFA886B423861285C97FFFFFFFFFFFFFFFF g = 2 q = 7FFFFFFFFFFFFFFFD6FC2A2C515DA54D57EE2B10139E9E78EC5CE2C1E7169B4AD4F09B208A3219FDE649CEE7124D9F7CBE97F1B1B1863AEC7B40D901576230BD69EF8F6AEAFEB2B09219FA8FAF83376842B1B2AA9EF68D79DAAB89AF3FABE49ACC278638707345BBF15344ED79F7F4390EF8AC509B56F39A98566527A41D3CBD5E0558C159927DB0E88454A5D96471FDDCB56D5BB06BFA340EA7A151EF1CA6FA572B76F3B1B95D8C8583D3E4770536B84F017E70E6FBF176601A0266941A17B0C8B97F4E74C2C1FFC7278919777940C1E1FF1D8DA637D6B99DDAFE5E17611002E2C778C1BE8B41D96379A51360D977FD4435A11C30942E4BFFFFFFFFFFFFFFFF "-----BEGIN DH PARAMETERS-----\n" "MIIBDAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz\n" "+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a\n" "87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7\n" "YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi\n" "7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD\n" "ssbzSibBsu/6iGtCOGEoXJf//////////wIBAgICB/8=\n" "-----END DH PARAMETERS-----\n"; ==34241== ==34241== HEAP SUMMARY: ==34241== in use at exit: 1,963 bytes in 9 blocks ==34241== total heap usage: 229 allocs, 220 frees, 89,623 bytes allocated ==34241== ==34241== LEAK SUMMARY: ==34241== definitely lost: 1,351 bytes in 4 blocks ==34241== indirectly lost: 612 bytes in 5 blocks ==34241== possibly lost: 0 bytes in 0 blocks ==34241== still reachable: 0 bytes in 0 blocks ==34241== suppressed: 0 bytes in 0 blocks ==34241== Rerun with --leak-check=full to see details of leaked memory ==34241== ==34241== For counts of detected and suppressed errors, rerun with: -v ==34241== Use --track-origins=yes to see where uninitialised values come from ==34241== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 0 from 0) Fix here: https://github.com/nomis/exim/commit/820a704a91a626510258849c39f3cbd64e127c44 That doesn't explain how the first "FFFFFFFFFFFFFFFFA" are missing from the value and that's not even a whole number of bytes. I can't reproduce it. -- You are receiving this mail because: You are on the CC list for the bug. -- ## List details at https://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
