From b4a333fea588b0df6f441f0e9838cff9338c71c4 Mon Sep 17 00:00:00 2001 From: Filippo Valsorda Date: Wed, 5 Mar 2025 12:08:35 +0100 Subject: [PATCH] crypto/internal/fips140/bigmod: explicitly clear expanded limbs on reset Russ Cox noticed that reset was clearing limbs up to the *previous* Nat size, not up to the new size, because clear(x.limbs) was happening before the x.limbs[:n] reslice. That's potentially a severe issue, because it may leave garbage in x.limbs[len(x.limbs):n] if n < cap(x.limbs). We were saved by an accidental invariant caused by the bug itself, though: x.limbs[len(x.limbs):cap(x.limbs)] are always zero. reset was always clearing all exposed (and hence potentially non-zero) limbs before shrinking the Nat, and the only other function that could shrink the Nat was trim, which only trims zero limbs. Near miss. Preserve the accidental invariant in the fix, because memclr is cheap and it just proved it can save us from potential mistakes. Change-Id: I6a6a4656a77735d8e8d520c699c4d85dd33ce497 Reviewed-on: https://go-review.googlesource.com/c/go/+/655056 Auto-Submit: Filippo Valsorda Reviewed-by: Junyang Shao LUCI-TryBot-Result: Go LUCI Reviewed-by: Roland Shoemaker --- src/crypto/internal/fips140/bigmod/nat.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/crypto/internal/fips140/bigmod/nat.go b/src/crypto/internal/fips140/bigmod/nat.go index 6757cccd02..7b690178b9 100644 --- a/src/crypto/internal/fips140/bigmod/nat.go +++ b/src/crypto/internal/fips140/bigmod/nat.go @@ -96,7 +96,8 @@ func (x *Nat) reset(n int) *Nat { x.limbs = make([]uint, n) return x } - clear(x.limbs) + // Clear both the returned limbs and the previously used ones. + clear(x.limbs[:max(n, len(x.limbs))]) x.limbs = x.limbs[:n] return x } -- 2.51.0