Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

steffengy/schannel-rs

              master @ ff7ffd3
            

Fixes

CVEs

HIGH

Peak severity

87.5%

Coverage

Highlights

Denial of Service: 6 prior fixes. Scrutinize any change in this area.

src/tls_stream.rs: most-fixed (7 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Recursive or looping decryption calls and incorrect state tracking (like `needs_read` and buffer limits) during TLS renegotiation have repeatedly led to infinite loops, hangs, and panics. Developers should carefully audit state updates when handling SEC_I_RENEGOTIATE.

Memory Safety: Passing temporary Rust structures directly to Windows SSPI FFI functions (like InitializeSecurityContext) has led to use-after-free conditions. Keeping backing buffers alive for the duration of the FFI lifecycle is vital.

Memory Corruption: Improper conversion of Rust vectors of structures to raw pointers for Schannel credentials can corrupt memory if the intermediate pointer layout is not correctly constructed.