Skip to content
Permalink
Browse files

Fix buffer overrun in SRP (#7484)

The old code got a pointer to the array instead of the first element, this resulted in a buffer overflow when the function was used more than once.
  • Loading branch information...
red-001 authored and nerzhul committed Jun 26, 2018
1 parent ae8ae6c commit 7bdf5eae05f63a98a13e520f98e68b9e7d9d544b
Showing with 1 addition and 1 deletion.
  1. +1 −1 src/util/srp.cpp
@@ -613,7 +613,7 @@ SRP_Result srp_create_salted_verification_key( SRP_HashAlgorithm alg,
if (fill_buff() != SRP_OK) goto error_and_exit;
*bytes_s = (unsigned char *)srp_alloc(size_to_fill);
if (!*bytes_s) goto error_and_exit;
memcpy(*bytes_s, &g_rand_buff + g_rand_idx, size_to_fill);
memcpy(*bytes_s, &g_rand_buff[g_rand_idx], size_to_fill);
g_rand_idx += size_to_fill;
}

0 comments on commit 7bdf5ea

Please sign in to comment.
You can’t perform that action at this time.