Tomáš Chvátal <[email protected]> writes: > we at suse ran address sanitizer against libnettle and found two bugs [1][2].
Thanks for the report, and sorry for the late reply. > The first one is easy to fix (simple off by one) and thus we already have the > patch (see attachment 0001-...). In the bug report, please include information about 1. which version of Nettle you used, and 2. what error you believe you are fixing. I guess this issue is fixed in the latest version, but not in 2.7.1. You may want to backport the same fix, see https://git.lysator.liu.se/nettle/nettle/commit/abf3870cba401bc797676cdee84fea0091a2a581 > The second one is about memory leaks, and it would be better if someone more > aware of the source took a look wether and how to fix it. This looks like the program eccdata doesn't free its storage before exit. This is a program used at build time to generate ecc-related tables. I'd accept patches to fix this, but I don't think it's very important. I think the nicest way is to add a function ecc_curve_clear to deallocate all storage, and add a call ecc_curve_clear (&ecc); at the end of the main function. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance. _______________________________________________ nettle-bugs mailing list [email protected] http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs
