File libcryptopp-CVE-2023-50980.patch of Package libcryptopp.32010

Overview Repositories Revisions Requests Users Attributes Meta

File libcryptopp-CVE-2023-50980.patch of Package libcryptopp.32010

Index: libcryptopp-5.6.5/gf2n.cpp
===================================================================
--- libcryptopp-5.6.5.orig/gf2n.cpp
+++ libcryptopp-5.6.5/gf2n.cpp
@@ -98,6 +98,14 @@ PolynomialMod2 PolynomialMod2::Monomial(
 
 PolynomialMod2 PolynomialMod2::Trinomial(size_t t0, size_t t1, size_t t2)
 {
+	// Asserts and checks due to Bing Shi
+	CRYPTOPP_ASSERT(t0 > t1);
+	CRYPTOPP_ASSERT(t1 > t2);
+
+	// The test is odd because of ECIES<EC2N>. The basis is t0, but the other coefficients are not in descending order.
+	if (t1 > t0 || t2 > t0)
+		throw InvalidArgument("PolynomialMod2: coefficients must be in descending order");
+
 	PolynomialMod2 r((word)0, t0+1);
 	r.SetBit(t0);
 	r.SetBit(t1);
@@ -107,6 +115,16 @@ PolynomialMod2 PolynomialMod2::Trinomial
 
 PolynomialMod2 PolynomialMod2::Pentanomial(size_t t0, size_t t1, size_t t2, size_t t3, size_t t4)
 {
+	// Asserts and checks due to Bing Shi
+	CRYPTOPP_ASSERT(t0 > t1);
+	CRYPTOPP_ASSERT(t1 > t2);
+	CRYPTOPP_ASSERT(t2 > t3);
+	CRYPTOPP_ASSERT(t3 > t4);
+
+	// The test is odd because of ECIES<EC2N>. The basis is t0, but the other coefficients are not in descending order.
+	if (t1 > t0 || t2 > t0 || t3 > t0 || t4 > t0)
+		throw InvalidArgument("PolynomialMod2: coefficients must be in descending order");
+
 	PolynomialMod2 r((word)0, t0+1);
 	r.SetBit(t0);
 	r.SetBit(t1);
@@ -600,7 +618,12 @@ GF2NT::GF2NT(unsigned int c0, unsigned i
 	, t0(c0), t1(c1)
 	, result((word)0, m)
 {
+	// Asserts and checks due to Bing Shi
 	CRYPTOPP_ASSERT(c0 > c1 && c1 > c2 && c2==0);
+
+	// The test is odd because of ECIES<EC2N>. The basis is c0, but the other coefficients are not in descending order.
+	if (c1 > c0 || c2 > c0)
+		throw InvalidArgument("GF2NT: coefficients must be in descending order");
 }
 
 const GF2NT::Element& GF2NT::MultiplicativeInverse(const Element &a) const

Places

File libcryptopp-CVE-2023-50980.patch of Package libcryptopp.32010

Places