Merge pull request #3504 from SparkiDev/fp_div_oob_read

TFM div: fix initial value of size in q so clamping doesn't OOB read
This commit is contained in:
toddouska 2020-11-18 16:15:08 -08:00 committed by GitHub
commit 3808865f57
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -679,7 +679,8 @@ int fp_div(fp_int *a, fp_int *b, fp_int *c, fp_int *d)
#endif
fp_init(q);
q->used = a->used + 2;
/* qb + d = a, and b is an integer > 0, therefore q <= a */
q->used = a->used;
fp_init(t1);
fp_init(t2);