Skip to content

Commit

Permalink
aggregate.c: remove code duplicate in blst_aggregate_in_g{12}.
Browse files Browse the repository at this point in the history
The modification was prompted by Guido Vranken's report on unitialized
memory with invalid uncompressed[!] input.
  • Loading branch information
dot-asm committed Aug 9, 2021
1 parent c8e76c6 commit eb61519
Showing 1 changed file with 14 additions and 22 deletions.
36 changes: 14 additions & 22 deletions src/aggregate.c
Original file line number Diff line number Diff line change
Expand Up @@ -529,23 +529,19 @@ BLST_ERROR blst_aggregate_in_g1(POINTonE1 *out, const POINTonE1 *in,
const unsigned char *zwire)
{
POINTonE1 P[1];
BLST_ERROR ret;

ret = POINTonE1_Deserialize_Z((POINTonE1_affine *)P, zwire);

if (ret != BLST_SUCCESS)
return ret;

if (zwire[0] & 0x40) { /* infinity? */
if (vec_is_zero(P, sizeof(POINTonE1_affine))) {
if (in == NULL)
vec_zero(out, sizeof(*out));
return BLST_SUCCESS;
}

if (zwire[0] & 0x80) { /* compressed? */
BLST_ERROR ret = POINTonE1_Uncompress((POINTonE1_affine *)P, zwire);
if (ret != BLST_SUCCESS)
return ret;
} else {
POINTonE1_Deserialize_BE((POINTonE1_affine *)P, zwire);
if (!POINTonE1_affine_on_curve((POINTonE1_affine *)P))
return BLST_POINT_NOT_ON_CURVE;
}

vec_copy(P->Z, BLS12_381_Rx.p, sizeof(P->Z));

if (!POINTonE1_in_G1(P))
Expand All @@ -563,23 +559,19 @@ BLST_ERROR blst_aggregate_in_g2(POINTonE2 *out, const POINTonE2 *in,
const unsigned char *zwire)
{
POINTonE2 P[1];
BLST_ERROR ret;

ret = POINTonE2_Deserialize_Z((POINTonE2_affine *)P, zwire);

if (ret != BLST_SUCCESS)
return ret;

if (zwire[0] & 0x40) { /* infinity? */
if (vec_is_zero(P, sizeof(POINTonE2_affine))) {
if (in == NULL)
vec_zero(out, sizeof(*out));
return BLST_SUCCESS;
}

if (zwire[0] & 0x80) { /* compressed? */
BLST_ERROR ret = POINTonE2_Uncompress((POINTonE2_affine *)P, zwire);
if (ret != BLST_SUCCESS)
return ret;
} else {
POINTonE2_Deserialize_BE((POINTonE2_affine *)P, zwire);
if (!POINTonE2_affine_on_curve((POINTonE2_affine *)P))
return BLST_POINT_NOT_ON_CURVE;
}

vec_copy(P->Z, BLS12_381_Rx.p, sizeof(P->Z));

if (!POINTonE2_in_G2(P))
Expand Down

0 comments on commit eb61519

Please sign in to comment.