Fix 1-byte buffer overflow in mbedtls_mpi_write_string()

This can only occur for negative numbers. Fixes Mbed-TLS#2404.
yanesca · Mar 6, 2019 · eff335d · eff335d
1 parent 3a70ab9
commit eff335d
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/library/bignum.c b/library/bignum.c
@@ -572,7 +572,10 @@ int mbedtls_mpi_write_string( const mbedtls_mpi *X, int radix,
     mbedtls_mpi_init( &T );
 
     if( X->s == -1 )
+    {
         *p++ = '-';
+        buflen--;
+    }
 
     if( radix == 16 )
     {