Skip to content

Commit 5c3164a

Browse files
committed
crypto: fix checkPrime crash with large buffers
Fixes: #56512
1 parent ad68d08 commit 5c3164a

File tree

2 files changed

+19
-0
lines changed

2 files changed

+19
-0
lines changed

src/crypto/crypto_random.cc

+6
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,12 @@ Maybe<void> CheckPrimeTraits::AdditionalConfig(
176176
ArrayBufferOrViewContents<unsigned char> candidate(args[offset]);
177177

178178
params->candidate = BignumPointer(candidate.data(), candidate.size());
179+
if (params->candidate.get() == nullptr) {
180+
ThrowCryptoError(Environment::GetCurrent(args),
181+
ERR_get_error(),
182+
"BignumPointer");
183+
return Nothing<void>();
184+
}
179185

180186
CHECK(args[offset + 1]->IsInt32()); // Checks
181187
params->checks = args[offset + 1].As<Int32>()->Value();

test/parallel/test-crypto-prime.js

+13
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ const {
1212
generatePrimeSync,
1313
checkPrime,
1414
checkPrimeSync,
15+
randomBytes,
1516
} = require('crypto');
1617

1718
const { Worker } = require('worker_threads');
@@ -254,6 +255,18 @@ for (const checks of [-(2 ** 31), -1, 2 ** 31, 2 ** 32 - 1, 2 ** 32, 2 ** 50]) {
254255
});
255256
}
256257

258+
{
259+
const bytes = randomBytes(67108864);
260+
assert.throws(() => checkPrime(bytes, common.mustNotCall()), {
261+
code: 'ERR_OSSL_BN_BIGNUM_TOO_LONG',
262+
message: /bignum too long/
263+
});
264+
assert.throws(() => checkPrimeSync(bytes), {
265+
code: 'ERR_OSSL_BN_BIGNUM_TOO_LONG',
266+
message: /bignum too long/
267+
});
268+
}
269+
257270
assert(!checkPrimeSync(Buffer.from([0x1])));
258271
assert(checkPrimeSync(Buffer.from([0x2])));
259272
assert(checkPrimeSync(Buffer.from([0x3])));

0 commit comments

Comments
 (0)