From 07b04ff7268a454ef8017270283d1c8f90c23ffc Mon Sep 17 00:00:00 2001 From: Kaz Kylheku Date: Wed, 8 Jun 2016 06:03:19 -0700 Subject: Fix out-of-bounds memory access in bit. * mpi/mpi.c (mp_bit): If the digit index is beyond the available digits in the number, report MP_NO rather than accessing undefined digit material or beyond the array entirely. --- mpi/mpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'mpi') diff --git a/mpi/mpi.c b/mpi/mpi.c index cb6567a5..178b5fee 100644 --- a/mpi/mpi.c +++ b/mpi/mpi.c @@ -2781,7 +2781,7 @@ mp_err mp_bit(mp_int *a, mp_digit bit) a = &tmp; } - return (DIGITS(a)[digit] & mask) != 0 ? MP_YES : MP_NO; + return (digit < USED(a) && (DIGITS(a)[digit] & mask) != 0) ? MP_YES : MP_NO; } mp_err mp_to_double(mp_int *mp, double *d) -- cgit v1.2.3