search

keybase / go-crypto

[mirror] Go supplementary cryptography libraries
https://godoc.org/golang.org/x/crypto
BSD 3-Clause "New" or "Revised" License
50 stars 20 forks source link

Fix out-of-bands access panics in curve_impl, add test #71

Closed zapu closed 6 years ago

zapu commented 6 years ago

Specially crafted PGP message bundle could cause panic when X coordinate of curve25519 shared encryption key was less than 32 bytes.

maxtaco commented 6 years ago

Can we get this merged upstream? It is just PGP or can it happen outside of PGP?

zapu commented 6 years ago

It's just PGP and only our fork, upstream does not have cv25519 support. Entirely my fault for not checking buffer sizes as well.