pcp

Am I allowed to be concerned that this is C code that opens up random files to be decrypted, slurps a 32 bit integer directly out of the file, passes that value to malloc, and then just a few lines later loops memcpy'ing into that buffer? https://github.com/TLINDEN/pcp/blob/master/libpcp/crypto.c#L... That's, like, 5 minutes worth of looking, most of it spent working out how to get from main() to the part of the code that actually starts taking attacker-controlled inputs; we're about 10 lines into the code that handles those inputs. Is that a real vulnerability? Hell if I know, but I'm scared of this code. Which is not to say I don't like it. There's a small utility function in there I'm stealing! The author is clearly smart and I hope this was an interesting project for them. But I don't recommend using this for real --- and I think neit

Could somebody please change the URL to https://github.com/TLINDEN/pcp instead?

On a related note, has anyone had a look at "Pretty Curved Privacy" ? https://github.com/TLINDEN/pcp (Just submitted it to hn - I thought there was an old submission, but apparently I was mistaken): https://news.ycombinator.com/item?id=12035081 If felony is PGP protocols wrapped in modern web technology, I suppose pcp is NaCl wrapped in old PGP command line and protocols...