{"action":"created","issue":{"url":"https://api.github.com/repos/rockdaboot/libpsl/issues/62","repository_url":"https://api.github.com/repos/rockdaboot/libpsl","labels_url":"https://api.github.com/repos/rockdaboot/libpsl/issues/62/labels{/name}","comments_url":"https://api.github.com/repos/rockdaboot/libpsl/issues/62/comments","events_url":"https://api.github.com/repos/rockdaboot/libpsl/issues/62/events","html_url":"https://github.com/rockdaboot/libpsl/issues/62","id":178517688,"number":62,"title":"OOB in _domain_to_punycode","user":{"login":"daurnimator","id":127971,"avatar_url":"https://avatars.githubusercontent.com/u/127971?v=3","gravatar_id":"","url":"https://api.github.com/users/daurnimator","html_url":"https://github.com/daurnimator","followers_url":"https://api.github.com/users/daurnimator/followers","following_url":"https://api.github.com/users/daurnimator/following{/other_user}","gists_url":"https://api.github.com/users/daurnimator/gists{/gist_id}","starred_url":"https://api.github.com/users/daurnimator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daurnimator/subscriptions","organizations_url":"https://api.github.com/users/daurnimator/orgs","repos_url":"https://api.github.com/users/daurnimator/repos","events_url":"https://api.github.com/users/daurnimator/events{/privacy}","received_events_url":"https://api.github.com/users/daurnimator/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-09-22T04:09:14Z","updated_at":"2016-09-22T04:18:35Z","closed_at":null,"body":"`input` is only 256 bytes (https://github.com/rockdaboot/libpsl/blob/6cfb33e5308d95f787e574f13c2b29d6fe27d42a/src/psl.c#L592)\r\n\r\nThere are several ways that libpsl may read or write beyond the end of that array.\r\n\r\nThis is *not* an error with in the current code as the 3rd parameter to `_domain_to_punycode` is always 128 at [the single calls site](https://github.com/rockdaboot/libpsl/blob/6cfb33e5308d95f787e574f13c2b29d6fe27d42a/src/psl.c#L778). However this assumption is very easy to break if `_domain_to_punycode` was to be used from elsewhere."},"comment":{"url":"https://api.github.com/repos/rockdaboot/libpsl/issues/comments/248807174","html_url":"https://github.com/rockdaboot/libpsl/issues/62#issuecomment-248807174","issue_url":"https://api.github.com/repos/rockdaboot/libpsl/issues/62","id":248807174,"user":{"login":"daurnimator","id":127971,"avatar_url":"https://avatars.githubusercontent.com/u/127971?v=3","gravatar_id":"","url":"https://api.github.com/users/daurnimator","html_url":"https://github.com/daurnimator","followers_url":"https://api.github.com/users/daurnimator/followers","following_url":"https://api.github.com/users/daurnimator/following{/other_user}","gists_url":"https://api.github.com/users/daurnimator/gists{/gist_id}","starred_url":"https://api.github.com/users/daurnimator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daurnimator/subscriptions","organizations_url":"https://api.github.com/users/daurnimator/orgs","repos_url":"https://api.github.com/users/daurnimator/repos","events_url":"https://api.github.com/users/daurnimator/events{/privacy}","received_events_url":"https://api.github.com/users/daurnimator/received_events","type":"User","site_admin":false},"created_at":"2016-09-22T04:18:35Z","updated_at":"2016-09-22T04:18:35Z","body":"Aside: `_domain_to_punycode` doesn't do unicode normalisation (which is a required part of punycode conversion). Perhaps you should drop support for it if neither libicu or libidn are installed?"}}
{"actor":{"display_login":"daurnimator"}}