From 61632dc166c25d172681a928583836b6bc2e1562 Mon Sep 17 00:00:00 2001 From: moneromooo-monero Date: Tue, 24 Jul 2018 21:23:08 +0100 Subject: ringct: prevent a potential very large allocation Reported by QuarksLab. --- src/ringct/rctTypes.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/ringct/rctTypes.h b/src/ringct/rctTypes.h index 5c02f92aa..ffc4df3ed 100644 --- a/src/ringct/rctTypes.h +++ b/src/ringct/rctTypes.h @@ -317,9 +317,9 @@ namespace rct { ar.begin_array(); uint32_t nbp = bulletproofs.size(); FIELD(nbp) - PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs); - if (bulletproofs.size() > outputs) + if (nbp > outputs) return false; + PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs); for (size_t i = 0; i < nbp; ++i) { FIELDS(bulletproofs[i]) -- cgit v1.2.3