Filippo Valsorda
69ecbb4d6d
When int is 32 bits wide (on 32-bit architectures like 386 and arm), an overflow could occur, causing a panic, due to malformed ASN.1 being passed to any of the ASN1 methods of String. Tested on linux/386 and darwin/amd64. This fixes CVE-2020-7919 and was found thanks to the Project Wycheproof test vectors. Change-Id: I8c9696a8bfad1b40ec877cd740dba3467d66ab54 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/645211 Reviewed-by: Katie Hockman <katiehockman@google.com> Reviewed-by: Adam Langley <agl@google.com> Reviewed-on: https://go-review.googlesource.com/c/crypto/+/216677 Run-TryBot: Katie Hockman <katie@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
This package runs a set of the Wycheproof tests provided by https://github.com/google/wycheproof.
The JSON test files live in https://github.com/google/wycheproof/tree/master/testvectors and are being fetched and cached at a pinned version every time these tests are run. To change the version of the wycheproof repository that is being used for testing, update wycheproofModVer.
The structs for these tests are generated from the schemas provided in https://github.com/google/wycheproof/tree/master/schemas using https://github.com/a-h/generate.