>From 45401d6b4297f4ace2cbc2f476cf44d1f7d8dd45 Mon Sep 17 00:00:00 2001 From: Nikos Mavrogiannopoulos Date: Fri, 31 Oct 2014 10:00:32 +0100 Subject: [PATCH 1/2] when exporting curve coordinates to X9.63 format, perform additional sanity checks on input Reported by Sean Burford. --- lib/gnutls_ecc.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/lib/gnutls_ecc.c b/lib/gnutls_ecc.c index 847f0d2..aa6399b 100644 --- a/lib/gnutls_ecc.c +++ b/lib/gnutls_ecc.c @@ -53,6 +53,11 @@ _gnutls_ecc_ansi_x963_export(gnutls_ecc_curve_t curve, bigint_t x, /* pad and store x */ byte_size = (_gnutls_mpi_get_nbits(x) + 7) / 8; + if (numlen < byte_size) { + ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + goto cleanup; + } + size = out->size - (1 + (numlen - byte_size)); ret = _gnutls_mpi_print(x, &out->data[1 + (numlen - byte_size)], @@ -63,6 +68,11 @@ _gnutls_ecc_ansi_x963_export(gnutls_ecc_curve_t curve, bigint_t x, } byte_size = (_gnutls_mpi_get_nbits(y) + 7) / 8; + if (numlen < byte_size) { + ret = gnutls_assert_val(GNUTLS_E_INVALID_REQUEST); + goto cleanup; + } + size = out->size - (1 + (numlen + numlen - byte_size)); ret = _gnutls_mpi_print(y, -- 2.0.0