Fix incorrect error path in ecc_sign_hash_internal.c #801

New issue

Open

opened 2026-09-02 10:14:55 -05:00 by headscott · 0 comments

headscott commented

2026-09-02 10:14:55 -05:00

(Migrated from github.com)

Description

There is an incorrect error path in src/pk/ecc/ecc_sign_hash_internal.c when the input buffer is too large for MAXBLOCKSIZE.

The code currently jumps to error, but at this point pubkey has not been initialized yet. The error cleanup path calls ecc_free(&pubkey), which can cause it to operate on uninitialized stack data.

Affected code

src/pk/ecc/ecc_sign_hash_internal.c:47

   if (pbytes >= MAXBLOCKSIZE) {
      err = CRYPT_BUFFER_OVERFLOW;
      goto error;
   }

Suggested Fix

   if (pbytes >= MAXBLOCKSIZE) {
      err = CRYPT_BUFFER_OVERFLOW;
      goto errnokey;
   }

### Description There is an incorrect error path in `src/pk/ecc/ecc_sign_hash_internal.c` when the input buffer is too large for MAXBLOCKSIZE. The code currently jumps to error, but at this point pubkey has not been initialized yet. The error cleanup path calls `ecc_free(&pubkey)`, which can cause it to operate on uninitialized stack data. **Affected code** `src/pk/ecc/ecc_sign_hash_internal.c:47` ```c if (pbytes >= MAXBLOCKSIZE) { err = CRYPT_BUFFER_OVERFLOW; goto error; } ``` **Suggested Fix** ```c if (pbytes >= MAXBLOCKSIZE) { err = CRYPT_BUFFER_OVERFLOW; goto errnokey; } ```