bech32: fix overflow bug.

rustyrussell · rustyrussell · commit a1898b699d46 · 2018-11-02T05:58:01.000Z
Copied from upstream: sipa/bech32@2b0aac6 Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
diff --git a/common/bech32.c b/common/bech32.c
@@ -99,7 +99,7 @@ int bech32_decode(char* hrp, uint8_t *data, size_t *data_len, const char *input,
         ++(*data_len);
     }
     hrp_len = input_len - (1 + *data_len);
-    if (hrp_len < 1 || *data_len < 6) {
+    if (1 + *data_len >= input_len || *data_len < 6) {
         return 0;
     }
     *(data_len) -= 6;

Original file line number	Diff line number	Diff line change
`@@ -99,7 +99,7 @@ int bech32_decode(char* hrp, uint8_t data, size_t data_len, const char *input,`
`99`	`99`	`++(*data_len);`
`100`	`100`	`}`
`101`	`101`	`hrp_len = input_len - (1 + *data_len);`
`102`		`- if (hrp_len < 1 \|\| *data_len < 6) {`
	`102`	`+ if (1 + data_len >= input_len \|\| data_len < 6) {`
`103`	`103`	`return 0;`
`104`	`104`	`}`
`105`	`105`	`*(data_len) -= 6;`