diff options
author | Werner Koch <wk@gnupg.org> | 2012-11-05 19:01:01 +0100 |
---|---|---|
committer | Werner Koch <wk@gnupg.org> | 2012-11-05 19:50:23 +0100 |
commit | d020143792013295f20e75e18a2b75d5b2e90c43 (patch) | |
tree | 921d63021cb03db04cc904aa377a5dd4082366bd | |
parent | 7a37ea4a49916439474b5a0e445333fa72889f55 (diff) | |
download | libgcrypt-d020143792013295f20e75e18a2b75d5b2e90c43.tar.gz |
Avoid dereferencing pointer right after the end
* mpi/mpicoder.c (do_get_buffer): Check the length before derefing P.
--
Christian Grothoff found this bug using Valgrind.
-rw-r--r-- | mpi/mpicoder.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mpi/mpicoder.c b/mpi/mpicoder.c index f499796d..a3435ed1 100644 --- a/mpi/mpicoder.c +++ b/mpi/mpicoder.c @@ -270,7 +270,7 @@ do_get_buffer (gcry_mpi_t a, unsigned int *nbytes, int *sign, int force_secure) /* This is sub-optimal but we need to do the shift operation because the caller has to free the returned buffer. */ - for (p=buffer; !*p && *nbytes; p++, --*nbytes) + for (p=buffer; *nbytes && !*p; p++, --*nbytes) ; if (p != buffer) memmove (buffer,p, *nbytes); |