Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
libp2p/go-openssl
master @ eada989
3
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Memory Corruption: 3 prior fixes. Scrutinize any change in this area.
conn.go: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Corruption: Passing raw, unpinned Go pointers to OpenSSL APIs like C.SSL_set_ex_data causes silent heap corruption when the Go GC moves or reclaims objects. Utilizing go-pointer for safe pinning is required to isolate C-managed pointers from Go GC sweeps.
Memory Corruption: Premature garbage collection of Go structs holding certificates, private keys, or X509 stores while they are actively referenced in C memory causes use-after-free vulnerabilities. Active keep-alive references must be explicitly maintained.
Memory Corruption: CGo function signature mismatches (e.g., in C.X509_check_host) trigger severe memory corruption or process termination when interacting with modern OpenSSL shared library versions.