Skip to content

Commit 78007c4

Browse files
andrea-caforioandreaskurth
authored andcommitted
[kat/rsa] Prevent stack smashing when copying RSA plaintext
An incorrect array size was used for the message buffer which resulted in memory writes that went beyond the allocated array corrupting the test data in the process. Signed-off-by: Andrea Caforio <[email protected]>
1 parent 06d697f commit 78007c4

File tree

1 file changed

+1
-1
lines changed
  • sw/device/tests/crypto/cryptotest/firmware

1 file changed

+1
-1
lines changed

sw/device/tests/crypto/cryptotest/firmware/rsa.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ status_t handle_rsa_encrypt(ujson_t *uj) {
143143
TRY(otcrypto_rsa_public_key_construct(rsa_size, modulus, &public_key));
144144

145145
// Create input message.
146-
uint8_t msg_buf[rsa_num_words];
146+
uint8_t msg_buf[uj_input.plaintext_len];
147147
memset(msg_buf, 0, sizeof(msg_buf));
148148
memcpy(msg_buf, uj_input.plaintext, uj_input.plaintext_len);
149149
otcrypto_const_byte_buf_t input_message = {

0 commit comments

Comments
 (0)