saymrwulf/curve25519-dalek-source
1
0
Fork 0
mirror of https://github.com/saymrwulf/curve25519-dalek-source.git synced 2026-09-04 20:24:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix a negate-with-overflow edgecase by widening before computation.

Browse source 
This fixes a bug in the Pippenger implementation reported by Fernando Krell and
diagnosed by Oleg Andreev.  The problem is that at the largest problem sizes
(using w=8), the signed digits fill the value range of an i8, and so doing
computation on them to calculate the bucket index can hit an overflow.

This was not caught in CI because the test suite didn't check all problem
sizes; tests for these sizes which expose this bug were added in the previous
commit.
This commit is contained in:
Henry de Valence 2019-06-05 20:59:07 -07:00
parent 6fe93564cd
commit 5f1d73bca0
2 changed files with 4 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/backend/serial/scalar_mul/pippenger.rs
View file

@ -125,7 +125,8 @@ impl VartimeMultiscalarMul for Pippenger {
// Note: if we add support for precomputed lookup tables,
// we'll be adding/subtracting point premultiplied by `digits[i]` to buckets[0].
for (digits, pt) in scalars_points.iter() {
let digit = digits[digit_index];
// Widen digit so that we don't run into edge cases when w=8.
let digit = digits[digit_index] as i16;
if digit > 0 {
let b = (digit - 1) as usize;
buckets[b] = (&buckets[b] + pt).to_extended();

3
src/backend/vector/scalar_mul/pippenger.rs
View file

@ -82,7 +82,8 @@ impl VartimeMultiscalarMul for Pippenger {
// Note: if we add support for precomputed lookup tables,
// we'll be adding/subtractiong point premultiplied by `digits[i]` to buckets[0].
for (digits, pt) in scalars_points.iter() {
let digit = digits[digit_index];
// Widen digit so that we don't run into edge cases when w=8.
let digit = digits[digit_index] as i16;
if digit > 0 {
let b = (digit - 1) as usize;
buckets[b] = &buckets[b] + pt;