Skip to content

Commit 2d66860

Browse files
hanno-beckermkannwischer
authored andcommitted
Fix context-length validation in ACVP test binary
Three places in acvp_mldsa.c validated the context argument length using `mlen > MAX_MSG_LENGTH` instead of `ctxlen > MAX_CTX_LENGTH`, meaning an oversized context would not be caught before being written into a MAX_CTX_LENGTH-sized stack buffer. Signed-off-by: Hanno Becker <beckphan@amazon.co.uk>
1 parent 5cac01c commit 2d66860

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

test/acvp/acvp_mldsa.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -644,7 +644,7 @@ int main(int argc, char *argv[])
644644
goto siggen_usage;
645645
}
646646
ctxlen = (strlen(*argv) - strlen("context=")) / 2;
647-
if (mlen > MAX_MSG_LENGTH ||
647+
if (ctxlen > MAX_CTX_LENGTH ||
648648
decode_hex("context", context, ctxlen, *argv) != 0)
649649
{
650650
goto siggen_usage;
@@ -745,7 +745,7 @@ int main(int argc, char *argv[])
745745
goto siggen_deterministic_usage;
746746
}
747747
ctxlen = (strlen(*argv) - strlen("context=")) / 2;
748-
if (mlen > MAX_MSG_LENGTH ||
748+
if (ctxlen > MAX_CTX_LENGTH ||
749749
decode_hex("context", context, ctxlen, *argv) != 0)
750750
{
751751
goto siggen_deterministic_usage;
@@ -825,7 +825,7 @@ int main(int argc, char *argv[])
825825
goto sigver_usage;
826826
}
827827
ctxlen = (strlen(*argv) - strlen("context=")) / 2;
828-
if (mlen > MAX_MSG_LENGTH ||
828+
if (ctxlen > MAX_CTX_LENGTH ||
829829
decode_hex("context", context, ctxlen, *argv) != 0)
830830
{
831831
goto sigver_usage;

0 commit comments

Comments
 (0)