Hacker News new | ask | show | jobs
by bertman 1516 days ago
The fix for OpenJDK (authored on Jan. 4th 22):

https://github.com/openjdk/jdk/blob/e2f8ce9c3ff4518e070960ba...
3 comments
drexlspivey 1516 days ago
with commit message “Improve ECDSA signature support” :D
link
baobabKoodaa 1516 days ago
I'm guessing the commit message is obscured to give people more time to update before it's exploited in the wild.
link
sdhfkjwefs 1516 days ago
Why are there no tests?
link
MrBuddyCasino 1516 days ago
I spot no test or comment in the code on why this assertion is important.
link
bertman 1515 days ago
It's literally what the whole bug is about. From OP's article:

>This is why the very first check in the ECDSA verification algorithm is to ensure that r and s are both >= 1. Guess which check Java forgot?

link
MrBuddyCasino 1515 days ago
Yes I just think it’s insane they fixed it without adding a test or comment.
link