{"action":"created","issue":{"url":"https://api.github.com/repos/cossacklabs/themis/issues/332","repository_url":"https://api.github.com/repos/cossacklabs/themis","labels_url":"https://api.github.com/repos/cossacklabs/themis/issues/332/labels{/name}","comments_url":"https://api.github.com/repos/cossacklabs/themis/issues/332/comments","events_url":"https://api.github.com/repos/cossacklabs/themis/issues/332/events","html_url":"https://github.com/cossacklabs/themis/issues/332","id":376166208,"node_id":"MDU6SXNzdWUzNzYxNjYyMDg=","number":332,"title":"Themis crashes if RSA keys are used incorrectly with Secure Message","user":{"login":"ilammy","id":1256587,"node_id":"MDQ6VXNlcjEyNTY1ODc=","avatar_url":"https://avatars0.githubusercontent.com/u/1256587?v=4","gravatar_id":"","url":"https://api.github.com/users/ilammy","html_url":"https://github.com/ilammy","followers_url":"https://api.github.com/users/ilammy/followers","following_url":"https://api.github.com/users/ilammy/following{/other_user}","gists_url":"https://api.github.com/users/ilammy/gists{/gist_id}","starred_url":"https://api.github.com/users/ilammy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ilammy/subscriptions","organizations_url":"https://api.github.com/users/ilammy/orgs","repos_url":"https://api.github.com/users/ilammy/repos","events_url":"https://api.github.com/users/ilammy/events{/privacy}","received_events_url":"https://api.github.com/users/ilammy/received_events","type":"User","site_admin":false},"labels":[{"id":208264162,"node_id":"MDU6TGFiZWwyMDgyNjQxNjI=","url":"https://api.github.com/repos/cossacklabs/themis/labels/bug","name":"bug","color":"fc2929","default":true},{"id":220153287,"node_id":"MDU6TGFiZWwyMjAxNTMyODc=","url":"https://api.github.com/repos/cossacklabs/themis/labels/core","name":"core","color":"5319e7","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-10-31T21:24:31Z","updated_at":"2018-11-01T13:06:37Z","closed_at":null,"author_association":"COLLABORATOR","body":"### Description\r\n\r\nExactly what it says on the tin: preventable programmer error may crash the application.\r\n\r\nIf the programmer accidentally swaps private and public RSA keys when unwrapping a Secure Message then application may crash.\r\n\r\nI've encountered this weird crash when writing tests for error handling of Secure Message. I misplaced the keys in arguments (admittedly, the list _is_ long). I expected a failure, but not a _spectacular_ one! 🦄 \r\n\r\n### Environment\r\n\r\n**OS:** reproduced on Ubuntu 18.04 as well as on macOS 10.12 (both x86_64)\r\n\r\n**Themis version:** 0.10.0 release\r\n\r\n**Crypto provider:**\r\n- Ubuntu: OpenSSL 1.1.0g\r\n- Ubuntu: OpenSSL 1.0.2n\r\n- macOS: OpenSSL 1.0.2p\r\n- macOS: LibreSSL 2.8.2\r\n\r\nSeems to be _not actual_ for BoringSSL (see notes below).\r\n\r\n### Details\r\n\r\nSteps to reproduce:\r\n\r\n1. Use [this code](https://gist.github.com/ilammy/2510dd8e78ff684e781497e444fccb04#file-crash-c).\r\n\r\nNote that `themis_secure_message_unwrap()` is called incorrectly: the private key should go first.\r\n\r\n2. Compile and run it:\r\n\r\n```console\r\n$ cc crash.c -lthemis\r\n```\r\n\r\n**Expected result:**\r\n\r\n```console\r\n$ ./a.out\r\nthemis_secure_message_unwrap() failed: 12\r\n```\r\n\r\nI'd expect Themis to detect the incorrect key usage and gracefully return an appropriate error code (invalid parameter).\r\n\r\n**Actual result:**\r\n\r\n```console\r\n$ ./a.out\r\nSegmentation fault: 11\r\n```\r\n\r\nHello darkness, my old friend!\r\n\r\n### Notes\r\n\r\nThe issue is not actual for ECDSA keys. If you replace `themis_gen_rsa_key_pair()` with `themis_gen_ec_key_pair()` then the program behaves as expected: Themis returns an error.\r\n\r\nThe issue is also not actual for BoringSSL (https://github.com/google/boringssl/commit/c8e0f90f83b9ec38ea833deb86b5a41360b62b6a). Unwrapping fails with a different error (11 = THEMIS_FAIL), but the application does not crash. Well, at least on my box."},"comment":{"url":"https://api.github.com/repos/cossacklabs/themis/issues/comments/435035034","html_url":"https://github.com/cossacklabs/themis/issues/332#issuecomment-435035034","issue_url":"https://api.github.com/repos/cossacklabs/themis/issues/332","id":435035034,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNTAzNTAzNA==","user":{"login":"secumod","id":6224695,"node_id":"MDQ6VXNlcjYyMjQ2OTU=","avatar_url":"https://avatars3.githubusercontent.com/u/6224695?v=4","gravatar_id":"","url":"https://api.github.com/users/secumod","html_url":"https://github.com/secumod","followers_url":"https://api.github.com/users/secumod/followers","following_url":"https://api.github.com/users/secumod/following{/other_user}","gists_url":"https://api.github.com/users/secumod/gists{/gist_id}","starred_url":"https://api.github.com/users/secumod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/secumod/subscriptions","organizations_url":"https://api.github.com/users/secumod/orgs","repos_url":"https://api.github.com/users/secumod/repos","events_url":"https://api.github.com/users/secumod/events{/privacy}","received_events_url":"https://api.github.com/users/secumod/received_events","type":"User","site_admin":false},"created_at":"2018-11-01T13:06:37Z","updated_at":"2018-11-01T13:06:37Z","author_association":"CONTRIBUTOR","body":"The test code indeed crashes."}}
{"actor":{"display_login":"secumod"}}