From 089d2af83f505eb41d4908134240ec77e87decd1 Mon Sep 17 00:00:00 2001 From: PuPha Date: Tue, 21 May 2024 15:42:06 +0700 Subject: [PATCH] fix(security_audit): 7 check input length --- Sources/LibAuk/Utils/secp256k1/Secp256k1.swift | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Sources/LibAuk/Utils/secp256k1/Secp256k1.swift b/Sources/LibAuk/Utils/secp256k1/Secp256k1.swift index 5fde27e..1d5570d 100644 --- a/Sources/LibAuk/Utils/secp256k1/Secp256k1.swift +++ b/Sources/LibAuk/Utils/secp256k1/Secp256k1.swift @@ -266,7 +266,8 @@ extension Secp256k1.Signing { var cSig = secp256k1_ecdsa_signature() // parse and serialize der - guard secp256k1_ecdsa_signature_parse_compact(context, &cSig, rawSignatureBytes) == 1, + guard rawSignatureBytes.count == 64, + secp256k1_ecdsa_signature_parse_compact(context, &cSig, rawSignatureBytes) == 1, secp256k1_ecdsa_signature_serialize_der(context, &derSignature, &derSize, &cSig) == 1 else { throw Secp256k1Error.invalidSignature }