diff options
| author | moneromooo-monero <moneromooo-monero@users.noreply.github.com> | 2020-09-24 15:16:44 +0000 |
|---|---|---|
| committer | moneromooo-monero <moneromooo-monero@users.noreply.github.com> | 2020-09-24 15:30:38 +0000 |
| commit | b6c4f8cd545a033859d3f7e91949f4883b856ed6 (patch) | |
| tree | 9c764c244a29fc2019d6ca0ab8a78227bcba220a /src/ringct | |
| parent | Merge pull request #6819 (diff) | |
| download | monero-b6c4f8cd545a033859d3f7e91949f4883b856ed6.tar.xz | |
fix a couple bugs found by OSS-fuzz
- index out of bounds when importing outputs
- accessing invalid CLSAG data
Diffstat (limited to 'src/ringct')
| -rw-r--r-- | src/ringct/rctTypes.h | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/ringct/rctTypes.h b/src/ringct/rctTypes.h index e073bb61b..00b72123a 100644 --- a/src/ringct/rctTypes.h +++ b/src/ringct/rctTypes.h @@ -368,6 +368,12 @@ namespace rct { template<bool W, template <bool> class Archive> bool serialize_rctsig_prunable(Archive<W> &ar, uint8_t type, size_t inputs, size_t outputs, size_t mixin) { + if (inputs >= 0xffffffff) + return false; + if (outputs >= 0xffffffff) + return false; + if (mixin >= 0xffffffff) + return false; if (type == RCTTypeNull) return ar.stream().good(); if (type != RCTTypeFull && type != RCTTypeSimple && type != RCTTypeBulletproof && type != RCTTypeBulletproof2 && type != RCTTypeCLSAG) |