mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-04-04 13:20:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add bounds check to residue input

Browse Source 
Signed-off-by: Janos Follath <janos.follath@arm.com>
This commit is contained in:
Janos Follath 2022-07-25 11:31:02 +01:00
parent 23bdeca64d
commit 8b718b5a66
2 changed files with 26 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
library/bignum_mod.h
View File

@ -67,7 +67,8 @@ void mbedtls_mpi_mod_residue_release( mbedtls_mpi_mod_residue *r );
int mbedtls_mpi_mod_residue_setup( mbedtls_mpi_mod_residue *r, int mbedtls_mpi_mod_residue_setup( mbedtls_mpi_mod_residue *r,
mbedtls_mpi_mod_modulus *m, mbedtls_mpi_mod_modulus *m,
mbedtls_mpi_uint *p ); mbedtls_mpi_uint *p,
size_t pn );
void mbedtls_mpi_mod_modulus_init( mbedtls_mpi_mod_modulus *m ); void mbedtls_mpi_mod_modulus_init( mbedtls_mpi_mod_modulus *m );

31
library/bignum_new.c
View File

@ -29,6 +29,7 @@
#include "bignum_core.h" #include "bignum_core.h"
#include "bignum_mod.h" #include "bignum_mod.h"
#include "bignum_mod_raw.h" #include "bignum_mod_raw.h"
#include "constant_time_internal.h"
#if defined(MBEDTLS_PLATFORM_C) #if defined(MBEDTLS_PLATFORM_C)
#include "mbedtls/platform.h" #include "mbedtls/platform.h"
@ -92,13 +93,17 @@ void mbedtls_mpi_mod_residue_release( mbedtls_mpi_mod_residue *r )
int mbedtls_mpi_mod_residue_setup( mbedtls_mpi_mod_residue *r, int mbedtls_mpi_mod_residue_setup( mbedtls_mpi_mod_residue *r,
mbedtls_mpi_mod_modulus *m, mbedtls_mpi_mod_modulus *m,
mbedtls_mpi_uint *X ) mbedtls_mpi_uint *p,
size_t pn )
{ {
if( X == NULL || m == NULL || r == NULL || X >= m->p) if( p == NULL || m == NULL || r == NULL )
return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
if( pn < m->n || !mbedtls_mpi_core_lt_ct( m->p, p, pn ) )
return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA ); return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
r->n = m->n; r->n = m->n;
r->p = X; r->p = p;
return( 0 ); return( 0 );
} }
@ -447,16 +452,28 @@ int mbedtls_mpi_mod_raw_read( mbedtls_mpi_uint *X,
unsigned char *buf, unsigned char *buf,
size_t buflen ) size_t buflen )
{ {
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
if( m->ext_rep & MBEDTLS_MPI_MOD_EXT_REP_LE ) if( m->ext_rep & MBEDTLS_MPI_MOD_EXT_REP_LE )
return mbedtls_mpi_core_read_le( X, m->n, buf, buflen ); ret = mbedtls_mpi_core_read_le( X, m->n, buf, buflen );
else if( m->ext_rep & MBEDTLS_MPI_MOD_EXT_REP_BE ) else if( m->ext_rep & MBEDTLS_MPI_MOD_EXT_REP_BE )
return mbedtls_mpi_core_read_be( X, m->n, buf, buflen ); ret = mbedtls_mpi_core_read_be( X, m->n, buf, buflen );
else else
return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA ); return( MBEDTLS_ERR_MPI_BAD_INPUT_DATA );
return( 0 ); if( ret != 0 )
goto cleanup;
if( !mbedtls_mpi_core_lt_ct( X, m->p, m->n ) )
{
ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
goto cleanup;
}
cleanup:
return( ret );
} }
int mbedtls_mpi_mod_raw_write( mbedtls_mpi_uint *X, int mbedtls_mpi_mod_raw_write( mbedtls_mpi_uint *X,