Skip to content

scryptenc: check for NULL after humansize() use - #412

Merged
cperciva merged 1 commit into
masterfrom
humansize-null
Jul 11, 2026
Merged

scryptenc: check for NULL after humansize() use#412
cperciva merged 1 commit into
masterfrom
humansize-null

Conversation

@gperciva

Copy link
Copy Markdown
Member

No description provided.

Comment thread lib/scryptenc/scryptenc.c Outdated
free(human_mem_minimum);

/* Success! */
return (0);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SCRYPT_OK?

Comment thread lib/scryptenc/scryptenc.c Outdated
free(human_mem_minimum);

/* Failure! */
return (-1);

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SCRYPT_ENOMEM?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whoops, I had that in, then took it out, then mis-added it back.

@cperciva

Copy link
Copy Markdown
Member

If we're going to pass the return code from display_params upstream, it needs to be a SCRYPT_* value.

And I'm thinking $10 for this one; "crash instead of exiting with an error" is arguably cosmetic, and in this particular case I can't imagine how it could be triggered by accident... in fact I'm not even sure how it could be triggered deliberately without a nerfed malloc.

@gperciva

Copy link
Copy Markdown
Member Author

Added REBASE commit

@cperciva

Copy link
Copy Markdown
Member

Fix looks good. Please tidy up the history and set the bounty to $10.

This should have been part of:
    2015-12-27 Use humansize in scryptenc
    e446f80

Reported by:	ChronoNova
Bug bounty:	$10 ("harmless")
@cperciva
cperciva merged commit defa711 into master Jul 11, 2026
2 checks passed
@gperciva
gperciva deleted the humansize-null branch July 11, 2026 20:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants