sahib
Potential security concern in rm_digest_hexstring function
Hi, I’d like to bring to your attention a potential security concern I noticed related to the rm_digest_steal function.
From my understanding, this function is called by rm_tm_extract, where the buffer length is 0x200. It seems that the parameter controlling the write to this buffer might be controllable, which could pose a security risk.
However, I want to emphasize that I haven’t verified this issue myself, and my confidence level in this observation is about 50%. Please consider reviewing this when you have time. I’m happy to provide more details or collaborate if needed. Thank you for your hard work on this project!
Sorry, I think I said it wrong, it should be the rm_digest_hexstring function
ret2ldz好,
Thank you for your research. It seems that rm_digest_hexstring is called with a fixed-sized buffer only when a specific compile-time debugging option is enabled, meaning that distribution-provided binaries of rmlint are not affected.
Do you think of any way an end user could manipulate the parameter that controls the write size (that is d->digest->bytes) in that case?
