MozillaSecurity / MozillaSecurity/cryptofuzz
AssertModResult aborts unconditionally when the modulus is zero
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 29
- Forks
- 18
- Avg merge
- 4m
- Merged PRs (30d)
- 1
Description
AssertModResult (tests.cpp:1035) aborts whenever result >= mod. With mod == 0 no unsigned value satisfies result < 0, so any module that returns success on a zero modulus aborts.
None of the call sites guard against it — Mod (1139), SqrMod (1154), ExpMod, AddMod, SubMod, MulMod, SqrtMod all call it directly.
OSS-Fuzz 513887571 against wolfssl is this case. cryptofuzz-normal-math --debug:
operation name: BignumCalc
calc operation: SqrMod(A,B)
bignum 1: 0
bignum 2: 0
Module wolfCrypt result: 0
BignumCalc ( SqrMod ): Result is equal to or larger than modulo
wolfCrypt returns 0 for SqrMod(0, 0), which is as good an answer as any for an undefined operation, and the assert fires regardless of what it returned.
Skipping the check when mod is zero, inside AssertModResult, would cover every call site.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at AssertModResult in tests.cpp:1035 and inspect the callers listed around Mod at 1139, SqrMod at 1154, and the other modular operations. Run cryptofuzz-normal-math --debug with the reported SqrMod(0, 0) case; done means a zero modulus no longer triggers the assertion while nonzero-modulus result checks remain unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- cryptography, testing-qa
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 85/100