micro-ecc
micro-ecc copied to clipboard
uECC_vli_mmod: Avoid potential buffer overrun
The shifting copy of mod into mod_multiple would overrun the destination if the high word of mod was zero, so word_shift > num_words.
This is not the case for any curve p or n, but this part of the code is written as if to support arbitrary mod, comment disclaimer notwithstanding.
Issue was detected via a static analysis tool.
Alternative would be to reduce the genericness and just use vli_numDigits on the high word to get bit_shift, and use num_words as word_shift.