Description
There is an incorrect error path in src/pk/ecc/ecc_sign_hash_internal.c when the input buffer is too large for MAXBLOCKSIZE.
The code currently jumps to error, but at this point pubkey has not been initialized yet. The error cleanup path calls ecc_free(&pubkey), which can cause it to operate on uninitialized stack data.
Affected code
src/pk/ecc/ecc_sign_hash_internal.c:47
if (pbytes >= MAXBLOCKSIZE) {
err = CRYPT_BUFFER_OVERFLOW;
goto error;
}
Suggested Fix
if (pbytes >= MAXBLOCKSIZE) {
err = CRYPT_BUFFER_OVERFLOW;
goto errnokey;
}
Description
There is an incorrect error path in
src/pk/ecc/ecc_sign_hash_internal.cwhen the input buffer is too large for MAXBLOCKSIZE.The code currently jumps to error, but at this point pubkey has not been initialized yet. The error cleanup path calls
ecc_free(&pubkey), which can cause it to operate on uninitialized stack data.Affected code
src/pk/ecc/ecc_sign_hash_internal.c:47Suggested Fix