Guido Vranken

Stack corruption

2

If a sufficient amount of AAAA records is associated with a DNS request, a buffer overflow will occur in write_record_aaaa; up to 11 bytes beyond the end of the output...

OSS-Fuzz integration

5

I've build a [cryptography implementation differential fuzzer](https://github.com/guidovranken/cryptofuzz) that has been running on OSS-Fuzz for a few weeks and has found some [nice bugs](https://github.com/guidovranken/cryptofuzz#hall-of-fame). I will be integrating Crypto++ support for...

You call mbedtls_ecp_mul without an RNG: https://github.com/catenacyber/elliptic-curve-differential-fuzzer/blob/6b624da397048c827eb1590a81444d08f5aed10f/modules/mbedtls.c#L47 But since https://github.com/ARMmbed/mbedtls/commit/75525aec527bc9d3bba2cd3214c3c8fc2d9961af it must be called with an RNG or it will always fail.

is_bailie_psw_probable_prime says 2 is not a prime

1

Probably not very important but technically this shouldn't crash: ```cpp #include #include #include #include int main(void) { const Botan::BigInt v(2); Botan::Modular_Reducer mod_n(v); assert(Botan::is_bailie_psw_probable_prime(v, mod_n)); return 0; } ```

ECDSA producing unverifiable or incorrect signatures for some curves

3

```cpp #include #include #include #include #include static void sign_verify(const std::string& curve) { ::Botan::System_RNG rng; const std::vector msg{0xFF}; std::unique_ptr signer; ::Botan::EC_Group group(curve); const ::Botan::BigInt priv_bn("1"); const auto priv = std::make_unique(::Botan::ECDSA_PrivateKey(rng, group,...

Re: Slow DH derivation

1

In response to your question why I constrained inputs to DH_Derive: https://github.com/guidovranken/cryptofuzz/commit/52fa502b21ad37ad49cd9062955ec38c28c7dd85#r49315676 I'm using Botan as an oracle in several of my OSS-Fuzz projects (Nettle, wolfCrypt, BearSSL, relic etc) and...

[thorchain] Add project

3

Initial integration for Thorchain, which is a (currently) top 60 cryptocurrency and has 3.8 billion USD market cap. This first PR builds a simple fuzzer for a parser; later this...

Continuous fuzzing with Google oss-fuzz

4

Is there an interest in fuzzing this project continually on Google [oss-fuzz](https://github.com/google/oss-fuzz)? Should I use https://github.com/gogo/fuzztests or is it out of date? Do you have a preference for specific .proto...

The DRBG random number generator can fail if an allocation failure occurs, e.g. here: https://github.com/wolfSSL/wolfssl/blob/3bb2d5525746b6a5d295d57789f2e08a33add740/wolfcrypt/src/random.c#L800 The user can check the RNG state by checking if `rng.status` equals `DRBG_OK`. In case...

SP math: Functions declared but not exported

1

When I compile wolfCrypt with SP math using these commands: https://github.com/guidovranken/cryptofuzz/blob/master/docs/wolfcrypt.md#sp-math The following program compiles but fails to link: ```c #include #include int main(void) { printf("%p, %p\n", ecc_projective_add_point_safe, ecc_map); return...