Commit 462696fd authored Mar 22, 2016 by Nicolai Stange Committed by Herbert Xu Apr 05, 2016

lib/mpi: mpi_read_buffer(): fix buffer overflow



Currently, mpi_read_buffer() writes full limbs to the output buffer
and moves memory around to purge leading zero limbs afterwards.

However, with

  commit 9cbe21d8 ("lib/mpi: only require buffers as big as needed for
                        the integer")

the caller is only required to provide a buffer large enough to hold the
result without the leading zeros.

This might result in a buffer overflow for small MP numbers with leading
zeros.

Fix this by coping the result to its final destination within the output
buffer and not copying the leading zeros at all.

Fixes: 9cbe21d8 ("lib/mpi: only require buffers as big as needed for
                      the integer")
Signed-off-by: Nicolai Stange <nicstange@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

parent 90f864e2

lib/mpi/mpicoder.c

+3 −10

Original line number	Diff line number	Diff line
		@@ -201,16 +201,9 @@ int mpi_read_buffer(MPI a, uint8_t buf, unsigned buf_len, unsigned nbytes,
		#else
		#error please implement for this limb size.
		#endif
		memcpy(p, &alimb, BYTES_PER_MPI_LIMB);
		p += BYTES_PER_MPI_LIMB;
		if (lzeros > 0) {
		mpi_limb_t limb1 = (void )p - sizeof(alimb);
		mpi_limb_t limb2 = (void )p - sizeof(alimb)
		+ lzeros;
		limb1 = limb2;
		p -= lzeros;
		lzeros -= sizeof(alimb);
		}
		memcpy(p, (u8 *)&alimb + lzeros, BYTES_PER_MPI_LIMB - lzeros);
		p += BYTES_PER_MPI_LIMB - lzeros;
		lzeros = 0;
		}
		return 0;
		}

Admin message