Merge pull request #34 from bitmark-inc/Sang/security_audit/7_check_i…

…nput_length fix(security_audit): 7 check input length
bitmark-inc · May 23, 2024 · ed812fa · ed812fa
2 parents eeba055 + 089d2af
commit ed812fa
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/Sources/LibAuk/Utils/secp256k1/Secp256k1.swift b/Sources/LibAuk/Utils/secp256k1/Secp256k1.swift
@@ -266,7 +266,8 @@ extension Secp256k1.Signing {
             var cSig = secp256k1_ecdsa_signature()
 
             // parse and serialize der
-            guard secp256k1_ecdsa_signature_parse_compact(context, &cSig, rawSignatureBytes) == 1,
+            guard rawSignatureBytes.count == 64,
+                secp256k1_ecdsa_signature_parse_compact(context, &cSig, rawSignatureBytes) == 1,
                   secp256k1_ecdsa_signature_serialize_der(context, &derSignature, &derSize, &cSig) == 1 else {
                 throw Secp256k1Error.invalidSignature
             }