From 8ecc6ce50ead28a0b8bab2f1fb18a58ee5204a13 Mon Sep 17 00:00:00 2001 From: Jonas Nick Date: Fri, 12 Jul 2019 10:00:39 +0000 Subject: [PATCH] Add check preventing rounding to alignment from wrapping around in scratch_alloc --- src/scratch_impl.h | 9 ++++++++- src/tests.c | 4 ++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/src/scratch_impl.h b/src/scratch_impl.h index 937e29a0dc476..f53de48bea38d 100644 --- a/src/scratch_impl.h +++ b/src/scratch_impl.h @@ -72,7 +72,14 @@ static size_t secp256k1_scratch_max_allocation(const secp256k1_callback* error_c static void *secp256k1_scratch_alloc(const secp256k1_callback* error_callback, secp256k1_scratch* scratch, size_t size) { void *ret; - size = ROUND_TO_ALIGN(size); + size_t rounded_size; + + rounded_size = ROUND_TO_ALIGN(size); + /* Check that rounding did not wrap around */ + if (rounded_size < size) { + return NULL; + } + size = rounded_size; if (memcmp(scratch->magic, "scratch", 8) != 0) { secp256k1_callback_call(error_callback, "invalid scratch space"); diff --git a/src/tests.c b/src/tests.c index 990f7d65eeb24..94deb4c1dea20 100644 --- a/src/tests.c +++ b/src/tests.c @@ -406,6 +406,10 @@ void run_scratch_tests(void) { * ALIGNMENT is greater than 1 because otherwise the objects take no extra * space. */ CHECK(ALIGNMENT <= 1 || !secp256k1_scratch_max_allocation(&none->error_callback, scratch, (SIZE_MAX / (ALIGNMENT - 1)) + 1)); + /* Try allocating SIZE_MAX to test wrap around which only happens if + * ALIGNMENT > 1, otherwise it returns NULL anyway because the scratch + * space is too small. */ + CHECK(secp256k1_scratch_alloc(&none->error_callback, scratch, SIZE_MAX) == NULL); secp256k1_scratch_space_destroy(none, scratch); /* cleanup */