mirror of
https://github.com/Xahau/xahaud.git
synced 2026-06-04 09:16:36 +00:00
Address issues identified by external review:
* RIPD-1617, RIPD-1619, RIPD-1621:
Verify serialized public keys more strictly before
using them.
* RIPD-1618:
* Simplify the base58 decoder logic.
* Reduce the complexity of the base58 encoder and
eliminate a potential out-of-bounds memory access.
* Improve type safety by using an `enum class` to
enforce strict type checking for token types.
* RIPD-1616:
Avoid calling `memcpy` with a null pointer even if the
size is specified as zero, since it results in undefined
behavior.
Acknowledgements:
Ripple thanks Guido Vranken for responsibly disclosing these
issues.
Bug Bounties and Responsible Disclosures:
We welcome reviews of the rippled code and urge researchers
to responsibly disclose any issues that they may find. For
more on Ripple's Bug Bounty program, please visit:
https://ripple.com/bug-bounty
This commit is contained in:
@@ -87,10 +87,8 @@ public:
|
||||
std::memcpy(ui.data(), seed.data(), seed.size());
|
||||
auto gsk = generatePrivateDeterministicKey(gen_, ui, ordinal);
|
||||
auto gpk = generatePublicDeterministicKey(gen_, ordinal);
|
||||
SecretKey const sk(Slice
|
||||
{ gsk.data(), gsk.size() });
|
||||
PublicKey const pk(Slice
|
||||
{ gpk.data(), gpk.size() });
|
||||
SecretKey const sk(Slice{ gsk.data(), gsk.size() });
|
||||
PublicKey const pk(Slice{ gpk.data(), gpk.size() });
|
||||
beast::secure_erase(ui.data(), ui.size());
|
||||
beast::secure_erase(gsk.data(), gsk.size());
|
||||
return {pk, sk};
|
||||
@@ -243,7 +241,7 @@ derivePublicKey (KeyType type, SecretKey const& sk)
|
||||
LogicError("derivePublicKey: secp256k1_ec_pubkey_create failed");
|
||||
|
||||
unsigned char pubkey[33];
|
||||
size_t len = sizeof(pubkey);
|
||||
std::size_t len = sizeof(pubkey);
|
||||
if(secp256k1_ec_pubkey_serialize(
|
||||
secp256k1Context(),
|
||||
pubkey,
|
||||
@@ -252,8 +250,7 @@ derivePublicKey (KeyType type, SecretKey const& sk)
|
||||
SECP256K1_EC_COMPRESSED) != 1)
|
||||
LogicError("derivePublicKey: secp256k1_ec_pubkey_serialize failed");
|
||||
|
||||
return PublicKey{Slice{pubkey,
|
||||
static_cast<std::size_t>(len)}};
|
||||
return PublicKey{Slice{ pubkey, len }};
|
||||
}
|
||||
case KeyType::ed25519:
|
||||
{
|
||||
|
||||
Reference in New Issue
Block a user