Skip to content

Fix critical vulnerabilities in eeg_rpsd: RNG seed and input validation #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

liincu4n
Copy link

issue background

2 critical vulnerabilities were identified in the eeg_rpsd function:

  1. fixed RNG seeds: the use of rng('default') and rand('state', 0) results in predictable random sequences, which can compromise the statistical randomness of data analysis and pose security risks.
  2. insufficient input validation: the function lacks proper validation for the EEG struct, nfreqs, and pct_data, potentially leading to runtime errors (e.g., array out-of-bounds or crashes).

these issues could affect the reliability of EEG data analysis and the stability of the program, particularly when handling sensitive data (e.g., medical data).

changes made

  1. RNG seed fix:
    1.1 replaced rng('default') and rand('state', 0) with time-based seeds (rng('shuffle') for MATLAB and rand('seed', sum(100*clock)) for Octave) to ensure true randomness.
    1.2 removed redundant rng('shuffle') call to streamline MATLAB/Octave compatibility.

  2. input validation:
    2.1 added validation for the EEG struct to ensure required fields (icaweights, icaact, srate, pnts, trials) are present.
    2.2 enhanced validation for nfreqs and pct_data to enforce positive integers and valid ranges (0 < pct_data <= 100).

impact

1.1 improved randomness and security, making the function suitable for sensitive data processing.
1.2 enhanced robustness by reducing the risk of crashes due to invalid inputs.
1.3 maintained compatibility with MATLAB and Octave.

1)replaced fixed RNG seeds (rng('default') and rand('state', 0)) with time-based seeds to ensure true randomness and improve security.
2)added input validation for EEG struct, nfreqs, and pct_data to prevent runtime errors and invalid inputs.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant