Skip to content

Commit 1e1fa59

Browse files
committed
math/big: fix shift for recursive division
The previous s value could cause a crash for certain inputs. Will check in tests and documentation improvements later. Thanks to the Go Ethereum team and the OSS-Fuzz project for reporting this. Thanks to Rémy Oudompheng and Robert Griesemer for their help developing and validating the fix. Fixes CVE-2020-28362 Change-Id: Ibbf455c4436bcdb07c84a34fa6551fb3422356d3 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/899974 Reviewed-by: Roland Shoemaker <[email protected]> Reviewed-by: Filippo Valsorda <[email protected]> Reviewed-on: https://go-review.googlesource.com/c/go/+/269657 Trust: Katie Hockman <[email protected]> Trust: Roland Shoemaker <[email protected]> Run-TryBot: Katie Hockman <[email protected]> Reviewed-by: Roland Shoemaker <[email protected]> TryBot-Result: Go Bot <[email protected]>
1 parent b34b0aa commit 1e1fa59

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/math/big/nat.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -929,7 +929,7 @@ func (z nat) divRecursiveStep(u, v nat, depth int, tmp *nat, temps []*nat) {
929929

930930
// Now u < (v<<B), compute lower bits in the same way.
931931
// Choose shift = B-1 again.
932-
s := B
932+
s := B - 1
933933
qhat := *temps[depth]
934934
qhat.clear()
935935
qhat.divRecursiveStep(u[s:].norm(), v[s:], depth+1, tmp, temps)

0 commit comments

Comments
 (0)