Commit 462696fd authored by Nicolai Stange's avatar Nicolai Stange Committed by Herbert Xu
Browse files

lib/mpi: mpi_read_buffer(): fix buffer overflow

Currently, mpi_read_buffer() writes full limbs to the output buffer
and moves memory around to purge leading zero limbs afterwards.

However, with

  commit 9cbe21d8 ("lib/mpi: only require buffers as big as needed for
                        the integer")

the caller is only required to provide a buffer large enough to hold the
result without the leading zeros.

This might result in a buffer overflow for small MP numbers with leading

Fix this by coping the result to its final destination within the output
buffer and not copying the leading zeros at all.

Fixes: 9cbe21d8

 ("lib/mpi: only require buffers as big as needed for
                      the integer")
Signed-off-by: default avatarNicolai Stange <>
Signed-off-by: default avatarHerbert Xu <>
parent 90f864e2
......@@ -201,16 +201,9 @@ int mpi_read_buffer(MPI a, uint8_t *buf, unsigned buf_len, unsigned *nbytes,
#error please implement for this limb size.
memcpy(p, &alimb, BYTES_PER_MPI_LIMB);
if (lzeros > 0) {
mpi_limb_t *limb1 = (void *)p - sizeof(alimb);
mpi_limb_t *limb2 = (void *)p - sizeof(alimb)
+ lzeros;
*limb1 = *limb2;
p -= lzeros;
lzeros -= sizeof(alimb);
memcpy(p, (u8 *)&alimb + lzeros, BYTES_PER_MPI_LIMB - lzeros);
p += BYTES_PER_MPI_LIMB - lzeros;
lzeros = 0;
return 0;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment