code wiki / _hdl_build / nx_recycler_bounds.nx
nx_recycler_bounds.nx source
↩ module page · 22 lines · 1626 B
1// nx_recycler_bounds.nx -- a hardening primitive RECYCLED FROM Heartbleed (CVE-2014-0160; the real intake artifact
2// is knowledge/fetched/recyc_heartbleed.raw). Heartbleed's root: OpenSSL copied a CALLER-CLAIMED payload length into
3// the response without clamping it to the bytes actually received -> it read ~64KB of adjacent process memory past
4// the real record. The fix-by-construction (what they lacked): NEVER trust a claimed length -- clamp to
5// min(claimed, available, capacity). This is the reusable bounds primitive the Nishi Recycler extracted from their
6// garbage; every sovereign parser (TLS/HTTP/X509) should move untrusted length-prefixed bytes through it. ORIGINAL
7import "nx_syscalls.nx"
8
9// move at most `claimed` bytes from src into dst, but NEVER more than `srclen` (available) or `dstcap` (room).
10// returns the actual count moved. A lying `claimed` (Heartbleed) is harmless: the available-clamp bounds the read.
11func rb_bounded_copy(dst: *u8, dstcap: i64, src: *u8, srclen: i64, claimed: i64) -> i64 {
12 var n: i64 = claimed
13 if n < 0 { n = 0 }
14 if n > srclen { n = srclen } // <-- the Heartbleed clamp: cannot read more than was received
15 if n > dstcap { n = dstcap } // cannot write more than fits
16 var i: i64 = 0
17 while i < n { dst[i] = src[i]; i = i + 1 }
18 return n
19}
20// 1 iff `claimed` would have over-read past the available bytes (the Heartbleed condition) -- a detector a parser
21// can use to FAIL LOUD on a malformed length field instead of silently clamping.
22func rb_is_overclaim(srclen: i64, claimed: i64) -> i64 { if claimed > srclen { return 1 } return 0 }