Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix potential memory leak in EC multiplication #3318

Merged
merged 4 commits into from
Jun 5, 2020
Merged

Fix potential memory leak in EC multiplication #3318

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6692a06
Fix potential memory leak in EC multiplication
tiod4420 May 8, 2020
923d579
Add test cases to check rng failure
tiod4420 May 13, 2020
4a67182
Add Changelog entry for #3318
tiod4420 May 13, 2020
b246214
Fix Changelag PR number and uniformize code when prng fails
tiod4420 May 28, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions library/ecp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1544,7 +1544,10 @@ static int ecp_randomize_jac( const mbedtls_ecp_group *grp, mbedtls_ecp_point *p
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );

if( count++ > 10 )
return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
{
ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
goto cleanup;
}
}
while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );

Expand Down Expand Up @@ -2278,7 +2281,10 @@ static int ecp_randomize_mxz( const mbedtls_ecp_group *grp, mbedtls_ecp_point *P
MBEDTLS_MPI_CHK( mbedtls_mpi_shift_r( &l, 1 ) );

if( count++ > 10 )
return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
{
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about to do this change @ line 2859 (line number in the initial version of the file) as well:

if( ++count > 30 )                                                   
    return( MBEDTLS_ERR_ECP_RANDOM_FAILED );
ret = mbedtls_mpi_lt_mpi_ct( d, &grp->N, &cmp );                     
    if( ret != 0 )                                                       
    {
        goto cleanup;                                                    
     }

I can see that there is no clean-up to do here (currently) but this would align with the code just below.

ret = MBEDTLS_ERR_ECP_RANDOM_FAILED;
goto cleanup;
}
}
while( mbedtls_mpi_cmp_int( &l, 1 ) <= 0 );

Expand Down