Skip to content

Commit

Permalink
mbedtls_mpi_sub_abs: Skip memcpy when redundant (#6701).
Browse files Browse the repository at this point in the history
In some contexts, the output pointer may equal the first input
pointer, in which case copying is not only superfluous but results in
"Source and destination overlap in memcpy" errors from Valgrind (as I
observed in the context of ecp_double_jac) and a diagnostic message
from TrustInSoft Analyzer (as Pascal Cuoq reported in the context of
other ECP functions called by cert-app with a suitable certificate).

Signed-off-by: Aaron M. Ucko <ucko@ncbi.nlm.nih.gov>
  • Loading branch information
ucko committed Jan 31, 2023
1 parent 9a10538 commit 78b823a
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 1 deletion.
4 changes: 4 additions & 0 deletions ChangeLog.d/conditionalize-mbedtls_mpi_sub_abs-memcpy.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
Bugfix
* Fix potential undefined behavior in mbedtls_mpi_sub_abs(). Reported by
Pascal Cuoq using TrustInSoft Analyzer in #6701; observed independently by
Aaron Ucko under Valgrind.
2 changes: 1 addition & 1 deletion library/bignum.c
Original file line number Diff line number Diff line change
Expand Up @@ -1280,7 +1280,7 @@ int mbedtls_mpi_sub_abs(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi
/* Set the high limbs of X to match A. Don't touch the lower limbs
* because X might be aliased to B, and we must not overwrite the
* significant digits of B. */
if (A->n > n) {
if (A->n > n && A != X) {
memcpy(X->p + n, A->p + n, (A->n - n) * ciL);
}
if (X->n > A->n) {
Expand Down

0 comments on commit 78b823a

Please sign in to comment.