• Nicolai Stange's avatar
    lib/mpi: mpi_read_buffer(): fix buffer overflow · 462696fd
    Nicolai Stange authored
    Currently, mpi_read_buffer() writes full limbs to the output buffer
    and moves memory around to purge leading zero limbs afterwards.
    
    However, with
    
      commit 9cbe21d8 ("lib/mpi: only require buffers as big as needed for
                            the integer")
    
    the caller is only required to provide a buffer large enough to hold the
    result without the leading zeros.
    
    This might result in a buffer overflow for small MP numbers with leading
    zeros.
    
    Fix this by coping the result to its final destination within the output
    buffer and not copying the leading zeros at all.
    
    Fixes: 9cbe21d8 ("lib/mpi: only require buffers as big as needed for
                          the integer")
    Signed-off-by: default avatarNicolai Stange <nicstange@gmail.com>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    462696fd
Name
Last commit
Last update
..
Makefile Loading commit data...
generic_mpih-add1.c Loading commit data...
generic_mpih-lshift.c Loading commit data...
generic_mpih-mul1.c Loading commit data...
generic_mpih-mul2.c Loading commit data...
generic_mpih-mul3.c Loading commit data...
generic_mpih-rshift.c Loading commit data...
generic_mpih-sub1.c Loading commit data...
longlong.h Loading commit data...
mpi-bit.c Loading commit data...
mpi-cmp.c Loading commit data...
mpi-inline.h Loading commit data...
mpi-internal.h Loading commit data...
mpi-pow.c Loading commit data...
mpicoder.c Loading commit data...
mpih-cmp.c Loading commit data...
mpih-div.c Loading commit data...
mpih-mul.c Loading commit data...
mpiutil.c Loading commit data...