allow_wraparound incorrectly documented
Bug #1093446 reported by
Andrew Cooke
This bug affects 1 person
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Python-Crypto |
Fix Committed
|
Undecided
|
Unassigned | ||
Bug Description
The documentation for Counter says:
allow_wraparound (boolean) - If True, the function will raise an OverflowError exception as soon as the counter wraps around. If False (default), the counter will simply restart from zero.
Which is very confusing. If the text is correct then setting this to true (ie setting ALLOW to TRUE) means that wraparound is DISALLOWED. The implementation is at the C level so I haven't looked or tested, but at the moment it's not clear if the docs are wrong, or
if the naming of the parameter is just monumentally dumb.
Marking this as a security vulnerability because if you get wraparound when you're not expecting it you could have duplicate streams.
| information type: | Private Security → Public Security |
Revision history for this message
| Andrew Cooke (ato2gx513oupn-andrew-n1by9anq91ai4) wrote | #1 |
| summary: |
- allow_wraparound misleadingly documented + allow_wraparound incorrectly documented |
Revision history for this message
| Andrew Cooke (ato2gx513oupn-andrew-n1by9anq91ai4) wrote | #2 |
| information type: | Public Security → Public |
| description: | updated |
| description: | updated |
| description: | updated |
Revision history for this message
| Legrandin (gooksankoo) wrote | #3 |
Revision history for this message
| Darsey Litzenberger (dlitz) wrote | #4 |
| Changed in pycrypto: | |
| status: | New → Fix Committed |
To post a comment you must log in.
So I went and wrote some tests. The documentation is incorrect; the parameter name is correct. So it should read:
allow_wraparound (boolean) - If *False* (default), the function will raise an OverflowError exception as soon as the counter wraps around. If True, the counter will simply restart from zero.
Note that the default (correctly, imho) remains False, so has shifted in the description above.