From 86472e2d967e0b211eeb0405955ba146c7a97f5f Mon Sep 17 00:00:00 2001 From: Armin Novak Date: Thu, 2 Jul 2026 08:02:26 +0200 Subject: [PATCH] [crypto] fix out buffer check --- libfreerdp/crypto/crypto.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/libfreerdp/crypto/crypto.c b/libfreerdp/crypto/crypto.c index 806f9b986..e6f156494 100644 --- a/libfreerdp/crypto/crypto.c +++ b/libfreerdp/crypto/crypto.c @@ -103,11 +103,14 @@ static SSIZE_T crypto_rsa_common(const BYTE* input, size_t length, UINT32 key_le goto fail; if (BN_mod_exp(y, x, exp, mod, ctx) != 1) goto fail; - output_length = BN_bn2bin(y, output); + { + const int len = BN_num_bytes(y); + if ((len < 0) || ((size_t)len > out_length)) + goto fail; + output_length = BN_bn2bin(y, output); + } if (output_length < 0) goto fail; - if ((size_t)output_length > out_length) - goto fail; crypto_reverse(output, output_length); if ((size_t)output_length < key_length)