Skip to content

Curve name buffer too small #1

@j-kaltes

Description

@j-kaltes

The program uses

char curve[9];

to save the name of the curve. The possible names are:

char* ellipticcurves [] = {
	"secp224k1",
	"secp224r1",
	"secp256k1",
	"secp256r1"
};

They consist of 9 characters plus a trailing ‘\0’, so they need 10 bytes, giving:

char curve[10];

Because of this:

./ecdsa --sign priv256.pem --message adc.dat --signature sig256.pem

gives the following output:

option --sign with value `priv256.pem'
Sign/Verify the message with value `adc.dat'
Signature is stored in file sig256.pem
Curve secp256r124f749e0f9d4904e1cd9a697cece8746f0a3583caf39a87302e2b4c4de883d65 was not built-in the program 
Error occurred. Invalid signature returned !

After changing to 10 bytes:

option --sign with value `priv256.pem'
Sign/Verify the message with value `adc.dat'
Signature is stored in file sig256.pem

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions