Skip to content
GitLab
    • GitLab: the DevOps platform
    • Explore GitLab
    • Install GitLab
    • How GitLab compares
    • Get started
    • GitLab docs
    • GitLab Learn
  • Pricing
  • Talk to an expert
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
    Projects Groups Topics Snippets
  • Register
  • Sign in
  • soundtouch soundtouch
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
  • Issues 6
    • Issues 6
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 1
    • Merge requests 1
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Artifacts
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Container Registry
    • Model experiments
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • SoundTouch library
  • soundtouchsoundtouch
  • Issues
  • #7
Closed
Open
Issue created Jul 27, 2018 by Adam@no_exec

Multiple reachable assertions

Two CVEs (CVE-2018-14044, CVE-2018-14045) were recently assigned for reachable assertions, the reproducers are available here:

https://github.com/TeamSeri0us/pocs/tree/master/soundtouch

Not sure if those folks reported it to you already, they didn't reply to me when asked. However, such assertions seem to be used all over the place and it should be easy to trigger other asserts as well. I don't think that's the correct use of assert in the code. How about throwing exceptions instead of asserts so the applications using this library have a chance to handle it somehow cleanly instead of aborting?

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking