Merge remote-tracking branch 'hanno/mpi_read_file_underflow' into development
* hanno/mpi_read_file_underflow:
Fix potential stack underflow in mpi_read_file.
diff --git a/ChangeLog b/ChangeLog
index 0cf927e..243bd6b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -28,6 +28,8 @@
Found by blaufish. Fixes #641.
* Fix incorrect sign computation in modular exponentiation
when dealing with negative MPI. Found by Guido Vranken.
+ * Fix potential stack underflow in mpi_read_file.
+ Found by Guido Vranken.
Changes
* Send fatal alerts in many more cases instead of dropping the connection.
diff --git a/include/mbedtls/bignum.h b/include/mbedtls/bignum.h
index a713313..1a5b4b6 100644
--- a/include/mbedtls/bignum.h
+++ b/include/mbedtls/bignum.h
@@ -340,7 +340,7 @@
#if defined(MBEDTLS_FS_IO)
/**
- * \brief Read X from an opened file
+ * \brief Read MPI from a line in an opened file
*
* \param X Destination MPI
* \param radix Input numeric base
@@ -349,6 +349,15 @@
* \return 0 if successful, MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL if
* the file read buffer is too small or a
* MBEDTLS_ERR_MPI_XXX error code
+ *
+ * \note On success, this function advances the file stream
+ * to the end of the current line or to EOF.
+ *
+ * The function returns 0 on an empty line.
+ *
+ * Leading whitespaces are ignored, as is a
+ * '0x' prefix for radix 16.
+ *
*/
int mbedtls_mpi_read_file( mbedtls_mpi *X, int radix, FILE *fin );
diff --git a/library/bignum.c b/library/bignum.c
index 8df2510..d3a150c 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -616,11 +616,11 @@
if( slen == sizeof( s ) - 2 )
return( MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL );
- if( s[slen - 1] == '\n' ) { slen--; s[slen] = '\0'; }
- if( s[slen - 1] == '\r' ) { slen--; s[slen] = '\0'; }
+ if( slen > 0 && s[slen - 1] == '\n' ) { slen--; s[slen] = '\0'; }
+ if( slen > 0 && s[slen - 1] == '\r' ) { slen--; s[slen] = '\0'; }
p = s + slen;
- while( --p >= s )
+ while( p-- > s )
if( mpi_get_digit( &d, radix, *p ) != 0 )
break;