Check r and s len before copying

This commit is contained in:
Eric Blankenhorn
2025-01-10 08:46:40 -06:00
parent 5b07d41cb3
commit 139504b9fd

View File

@ -33779,8 +33779,14 @@ int DecodeECC_DSA_Sig_Bin(const byte* sig, word32 sigLen, byte* r, word32* rLen,
ret = GetASNInt(sig, &idx, &len, sigLen); ret = GetASNInt(sig, &idx, &len, sigLen);
if (ret != 0) if (ret != 0)
return ret; return ret;
if (rLen) if (rLen) {
*rLen = (word32)len; if (*rLen >= (word32)len)
*rLen = (word32)len;
else {
/* Buffer too small to hold r value */
return BUFFER_E;
}
}
if (r) if (r)
XMEMCPY(r, (byte*)sig + idx, (size_t)len); XMEMCPY(r, (byte*)sig + idx, (size_t)len);
idx += (word32)len; idx += (word32)len;
@ -33788,8 +33794,14 @@ int DecodeECC_DSA_Sig_Bin(const byte* sig, word32 sigLen, byte* r, word32* rLen,
ret = GetASNInt(sig, &idx, &len, sigLen); ret = GetASNInt(sig, &idx, &len, sigLen);
if (ret != 0) if (ret != 0)
return ret; return ret;
if (sLen) if (sLen) {
*sLen = (word32)len; if (*sLen >= (word32)len)
*sLen = (word32)len;
else {
/* Buffer too small to hold r value */
return BUFFER_E;
}
}
if (s) if (s)
XMEMCPY(s, (byte*)sig + idx, (size_t)len); XMEMCPY(s, (byte*)sig + idx, (size_t)len);