Botan: Integer overflow in FFI block size reporting can cause memory corruption
The Botan cryptography library reports the block size of a block cipher through its C API without checking for overflow when converting to int. An application that accepts external algorithm parameter strings and uses the FFI raw ECB mode can be tricked by an attacker into selecting the variable-block-size Lion cipher, leading to truncated size reporting, insufficient buffer allocation and memory corruption. The C++ API and commonly used C API modes such as CBC and CTR are not affected.
Botan Project · Botan
