Null pointer dereference – new security bug for OpenSSL

Good to note that this was found with KLEE[1]. KLEE is a good for symbolic execution of code and is very cool[2].<p>This only triggers a crash if you use RELEASE_BUFFERS (not the default) and a warning alert is written when the socket buffer is full. About the only case where a warning alert is generated is when a client attempts a renegotiation without the renegotiation extension (unless insecure renegotiation is allowed by the app). I&#x27;ve not been able to trigger the bug in a test because code generally stops reading once the socket buffer is full so you need the application to exactly fill the socket buffer (so that it doesn&#x27;t get EAGAIN), then a warning alert can just exceed it.<p>[1] <a href="http://marc.info/?l=openssl-dev&amp;m=139809493725682&amp;w=2" rel="nofollow">http:&#x2F;&#x2F;marc.info&#x2F;?l=openssl-dev&amp;m=139809493725682&amp;w=2</a> [2] <a href="http://klee.github.io/klee/" rel="nofollow">http:&#x2F;&#x2F;klee.github.io&#x2F;klee&#x2F;</a>

Are there any write ups for this yet? I can&#x27;t find a CVE or anything on this one. No word from OpenSSL yet either.

That patch is set up for a later bug to be introduced: no brackets on the if statements.<p>Instead of:<p><pre><code> + if (wb-&gt;buf == NULL) + if (!ssl3_setup_write_buffer(s)) + return -1; </code></pre> Why not:<p><pre><code> + if (wb-&gt;buf == NULL) { + if (!ssl3_setup_write_buffer(s)) { + return -1; + } + }</code></pre>

Like I said in the other thread on 5.5, make sure you update for the patches. <a href="http://www.openbsd.org/errata55.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;errata55.html</a><p>This one is listed on that page (bottom 005: SECURITY FIX: May 1, 2014).

You can thank the people that found the bug here:<p><a href="http://www.openbsdfoundation.org/donations.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsdfoundation.org&#x2F;donations.html</a><p><a href="http://www.openbsd.org/donations.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;donations.html</a><p><a href="http://www.openbsd.org/want.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;want.html</a>

Is it me or should code that has to be secure be written in more manage languages to prevent these mistake ? (But managed languages probably have other security issues I don&#x27;t know about ?)

Are we better off using decoder rings and snail mail at this point?