Commit 7af791e0 authored by Nicolai Stange's avatar Nicolai Stange Committed by Herbert Xu
Browse files

lib/mpi: mpi_read_from_buffer(): return -EINVAL upon too short buffer

Currently, if the input buffer is shorter than the expected length as
indicated by its first two bytes, an MPI instance of this expected length
will be allocated and filled with as much data as is available. The rest
will remain uninitialized.

Instead of leaving this condition undetected, an error code should be
reported to the caller.

Since this situation indicates that the input buffer's first two bytes,
encoding the number of expected bits, are garbled, -EINVAL is appropriate

If the input buffer is shorter than indicated by its first two bytes,
make mpi_read_from_buffer() return -EINVAL.
Get rid of the 'nread' variable: with the new semantics, the total number
of bytes read from the input buffer is known in advance.
Signed-off-by: default avatarNicolai Stange <>
Signed-off-by: default avatarHerbert Xu <>
parent c5ce7c69
......@@ -81,7 +81,7 @@ MPI mpi_read_from_buffer(const void *xbuffer, unsigned *ret_nread)
const uint8_t *buffer = xbuffer;
int i, j;
unsigned nbits, nbytes, nlimbs, nread = 0;
unsigned nbits, nbytes, nlimbs;
mpi_limb_t a;
MPI val = NULL;
......@@ -94,9 +94,14 @@ MPI mpi_read_from_buffer(const void *xbuffer, unsigned *ret_nread)
return ERR_PTR(-EINVAL);
buffer += 2;
nread = 2;
nbytes = DIV_ROUND_UP(nbits, 8);
if (nbytes + 2 > *ret_nread) {
printk("MPI: mpi larger than buffer nread=%d ret_nread=%d\n",
*ret_nread + 1, *ret_nread);
return ERR_PTR(-EINVAL);
nlimbs = DIV_ROUND_UP(nbytes, BYTES_PER_MPI_LIMB);
val = mpi_alloc(nlimbs);
if (!val)
......@@ -109,12 +114,6 @@ MPI mpi_read_from_buffer(const void *xbuffer, unsigned *ret_nread)
for (; j > 0; j--) {
a = 0;
for (; i < BYTES_PER_MPI_LIMB; i++) {
if (++nread > *ret_nread) {
("MPI: mpi larger than buffer nread=%d ret_nread=%d\n",
nread, *ret_nread);
goto leave;
a <<= 8;
a |= *buffer++;
......@@ -122,8 +121,7 @@ MPI mpi_read_from_buffer(const void *xbuffer, unsigned *ret_nread)
val->d[j - 1] = a;
*ret_nread = nread;
*ret_nread = nbytes + 2;
return val;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment