Project

General

Profile

Actions
Copy link

Bug #12783

closed

Segmentation fault when verifying RSA signature

Added by toupeira (Markus Koller) over 8 years ago. Updated over 8 years ago.

Status:
Closed
Assignee:
rhenium (Kazuki Yamaguchi)
Target version:
-
ruby -v:
ruby 2.3.1p112 (2016-04-26 revision 54768) [x86_64-linux]
Backport:
2.1: UNKNOWN, 2.2: UNKNOWN, 2.3: UNKNOWN
[ruby-core:77352]

Description

I ran into a segfault while using the json-jwt gem, it happens when trying to verify the RSA signature using the OpenSSL library. I've attached a minimal test case which triggers the segfault without going through json-jwt, along with the binary input data. The original non-binary format of the signature/JWT seems to be correct according to the validator at https://jwt.io/.

I'm on Debian sid with libssl 1.0.2h-1, and I could reproduce the segfault with several Ruby versions from 2.4.0-preview2 back to 2.1.10 (didn't try earlier ones). I also tried the newer libssl 1.1 (which caused compile errors with Ruby 2.3.1) as well as 1.0.1 (which I gave up on because I couldn't find out how to force Ruby to compile with the older version).

Let me know if there's more debugging information I can provide you with.

Files

Download all files
segfault.log (13.2 KB) segfault.log Output of test script toupeira (Markus Koller), 09/22/2016 12:48 PM
segfault.rb (266 Bytes) segfault.rb Test script to trigger the segfault toupeira (Markus Koller), 09/22/2016 12:48 PM
signature (256 Bytes) signature Input data for test script, needs to be in the same folder toupeira (Markus Koller), 09/22/2016 12:48 PM
signature_base_string (845 Bytes) signature_base_string Input data for test script, needs to be in the same folder toupeira (Markus Koller), 09/22/2016 12:48 PM
Actions
Copy link
 #1 [ruby-core:77366]

Updated by rhenium (Kazuki Yamaguchi) over 8 years ago

  • Status changed from Open to Closed
  • Assignee changed from MartinBosslet (Martin Bosslet) to rhenium (Kazuki Yamaguchi)
Actions
Copy link

Also available in: Atom PDF

Like0
Like0