Skip to content

Add input check to mp_pack and mp_pack_count#602

Open
MagicalTux wants to merge 1 commit into
libtom:developfrom
MagicalTux:fix-pack-div-by-zero
Open

Add input check to mp_pack and mp_pack_count#602
MagicalTux wants to merge 1 commit into
libtom:developfrom
MagicalTux:fix-pack-div-by-zero

Conversation

@MagicalTux

Copy link
Copy Markdown
Contributor

mp_pack_count computes bits / ((size*8) - nails). When nails == size*8 the divisor is zero — a division by zero (SIGFPE on x86). mp_pack calls mp_pack_count unconditionally, so the same crash is reachable through mp_pack.

Like mp_unpack, these parameters can originate from an external format, making the bad combination reachable from untrusted input.

Fix: reject size == 0 and nails >= size*8 early in both functions (mp_pack_count returns 0, mp_pack returns MP_VAL). The check is placed before mp_count_bits in mp_pack_count.

Confirmed with UndefinedBehaviorSanitizer:

mp_pack_count.c:9:18: runtime error: division by zero

Reproducer: mp_pack_count(&a, 8, 1);

When nails == size*8 the (size*8) - nails divisor was zero, causing a
division by zero.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant