coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-11-09 14:50:17 +08:00
Code Issues Packages Projects Releases Wiki Activity

ECDH: fix possible buffer overflow

Browse Source 
We were not comparing the size of the output buffer with the actual
number of bytes we were going to write to it, but with something
possibly smaller.

Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
This commit is contained in:
Manuel Pégourié-Gonnard 2026-03-30 11:20:52 +02:00
parent 058f57a4dd
commit 1d71bcc31c
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
library/ecdh.c
View File

@ -646,11 +646,13 @@ static int ecdh_calc_secret_internal(mbedtls_ecdh_context_mbed *ctx,
}
#endif /* MBEDTLS_ECP_RESTARTABLE */
if (mbedtls_mpi_size(&ctx->z) > blen) {
size_t p_bytes = ctx->grp.pbits / 8 + ((ctx->grp.pbits % 8) != 0);
if (p_bytes > blen) {
return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
}
*olen = ctx->grp.pbits / 8 + ((ctx->grp.pbits % 8) != 0);
*olen = p_bytes;
if (mbedtls_ecp_get_type(&ctx->grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) {
return mbedtls_mpi_write_binary_le(&ctx->z, buf, *olen);