fix: V-001 security vulnerability

Automated security fix generated by Orbis Security AI
This commit is contained in:
orbisai0security 2026-04-30 13:45:43 +00:00
parent 01036bed83
commit bfc01a1a61

View file

@ -120,7 +120,7 @@ int ecdsa_signature_parse_der_lax(const secp256k1_context* ctx, secp256k1_ecdsa_
/* Copy R value */ /* Copy R value */
if (rlen > 32) { if (rlen > 32) {
overflow = 1; overflow = 1;
} else if (rlen) { } else if (rlen > 0 && rlen <= 32) {
memcpy(tmpsig + 32 - rlen, input + rpos, rlen); memcpy(tmpsig + 32 - rlen, input + rpos, rlen);
} }
@ -132,7 +132,7 @@ int ecdsa_signature_parse_der_lax(const secp256k1_context* ctx, secp256k1_ecdsa_
/* Copy S value */ /* Copy S value */
if (slen > 32) { if (slen > 32) {
overflow = 1; overflow = 1;
} else if (slen) { } else if (slen > 0 && slen <= 32) {
memcpy(tmpsig + 64 - slen, input + spos, slen); memcpy(tmpsig + 64 - slen, input + spos, slen);
} }