copensslsizeofcve

Please explain OpenSSL CVE-2022-3786 'sizeof' change


What is difference between these 2 sizeof operator uses?

From here: https://github.com/openssl/openssl/commit/680e65b94c916af259bfdc2e25f1ab6e0c7a97d6?diff=split

unsigned int *pDecoded

...

memmove(pDecoded + i + 1, pDecoded + i, (written_out - i) * sizeof *pDecoded);
memmove(pDecoded + i + 1, pDecoded + i, (written_out - i) * sizeof (*pDecoded));

I think sizeof *PDecoded returns sizeof pointer to unsigned int. Whereas, sizeof (*pDecoded) returns sizeof unsigned int.


Solution

  • There is no difference; these expressions are equivalent.

    #include <stdio.h>
    
    int main(void)
    {
        unsigned int *foo;
    
        printf("sizeof foo <%zu> | sizeof *foo <%zu> or <%zu>\n",
                sizeof foo, sizeof *foo, sizeof (*foo));
    }
    

    Output (on my machine):

    sizeof foo <8> | sizeof *foo <4> or <4>
    

    This looks like a style choice. The only other use of sizeof in the file also has superfluous parenthesis:

    char a_ulabel[LABEL_BUF_SIZE + 1];
    size_t a_size = sizeof(a_ulabel);
    

    The parenthesis are only required when the operand is a type:

    sizeof (int)
    

    Otherwise, they are used to influence operator precedence.