32 lines
1009 B
Diff
32 lines
1009 B
Diff
From 86472e2d967e0b211eeb0405955ba146c7a97f5f Mon Sep 17 00:00:00 2001
|
|
From: Armin Novak <armin.novak@thincast.com>
|
|
Date: Thu, 2 Jul 2026 08:02:26 +0200
|
|
Subject: [PATCH] [crypto] fix out buffer check
|
|
|
|
---
|
|
libfreerdp/crypto/crypto.c | 9 ++++++---
|
|
1 file changed, 6 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/libfreerdp/crypto/crypto.c b/libfreerdp/crypto/crypto.c
|
|
index 806f9b986..e6f156494 100644
|
|
--- a/libfreerdp/crypto/crypto.c
|
|
+++ b/libfreerdp/crypto/crypto.c
|
|
@@ -103,11 +103,14 @@ static SSIZE_T crypto_rsa_common(const BYTE* input, size_t length, UINT32 key_le
|
|
goto fail;
|
|
if (BN_mod_exp(y, x, exp, mod, ctx) != 1)
|
|
goto fail;
|
|
- output_length = BN_bn2bin(y, output);
|
|
+ {
|
|
+ const int len = BN_num_bytes(y);
|
|
+ if ((len < 0) || ((size_t)len > out_length))
|
|
+ goto fail;
|
|
+ output_length = BN_bn2bin(y, output);
|
|
+ }
|
|
if (output_length < 0)
|
|
goto fail;
|
|
- if ((size_t)output_length > out_length)
|
|
- goto fail;
|
|
crypto_reverse(output, output_length);
|
|
|
|
if ((size_t)output_length < key_length)
|