Skip to content

Commit e389227

Browse files
committed
Merged PR 15134783: Fix comparison with wider type in mldsa_primitives.c
This was found by CodeQL: > Comparison with wider type at mldsa_primitives.c:792. A loop variable or comparison operand is implicitly widened, potentially causing CWE-190/197/835. It's not an issue in practice as the max loop bound is `7*8=56` for the largest ML-DSA parameter set, and this is also checked by assertions. However, it's easy to fix the issue by changing to `UINT32`. Related work items: #60592557
1 parent 88bdeee commit e389227

1 file changed

Lines changed: 1 addition & 2 deletions

File tree

lib/mldsa_primitives.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -779,7 +779,6 @@ SymCryptMlDsaMatrixCreate(
779779
SYMCRYPT_ASSERT( nRows <= SYMCRYPT_MLDSA_MATRIX_MAX_NROWS );
780780
SYMCRYPT_ASSERT( nCols <= SYMCRYPT_MLDSA_MATRIX_MAX_NCOLS );
781781
SYMCRYPT_ASSERT( cbBuffer == SYMCRYPT_INTERNAL_MLDSA_SIZEOF_MATRIX(nRows, nCols) );
782-
SYMCRYPT_ASSERT( (UINT32) nRows * nCols <= UINT8_MAX );
783782

784783
PSYMCRYPT_MLDSA_MATRIX pMatrix = (PSYMCRYPT_MLDSA_MATRIX) pbBuffer;
785784
SYMCRYPT_ASSERT( pMatrix != NULL );
@@ -789,7 +788,7 @@ SymCryptMlDsaMatrixCreate(
789788
pMatrix->cbTotalSize = cbBuffer;
790789

791790
PBYTE pbCurrent = pbBuffer + sizeof(SYMCRYPT_MLDSA_MATRIX);
792-
for(UINT8 i = 0; i < nRows * nCols; ++i)
791+
for(UINT32 i = 0; i < (UINT32) nRows * nCols; ++i)
793792
{
794793
SymCryptMlDsaPolyElementCreate( pbCurrent, SYMCRYPT_INTERNAL_MLDSA_SIZEOF_POLYELEMENT );
795794
pbCurrent += SYMCRYPT_INTERNAL_MLDSA_SIZEOF_POLYELEMENT;

0 commit comments

Comments
 (0)