From de670bd5b2b1dff06b09d4e0b7b6bcb6f5cce93a Mon Sep 17 00:00:00 2001 From: "Owain G. Ainsworth" Date: Mon, 17 Mar 2014 17:47:27 +0000 Subject: [PATCH] check for 0 length strings in pubkey parser. We check length later, but we assumed it was always 1 bytes long. Not always the case. I'm a little depressed that this bug was there. --- pubkey.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pubkey.go b/pubkey.go index 070bbc295..72772809c 100644 --- a/pubkey.go +++ b/pubkey.go @@ -6,6 +6,7 @@ package btcec import ( "crypto/ecdsa" + "errors" "fmt" "math/big" ) @@ -53,6 +54,10 @@ func ParsePubKey(pubKeyStr []byte, curve *KoblitzCurve) (key *ecdsa.PublicKey, e pubkey := ecdsa.PublicKey{} pubkey.Curve = curve + if len(pubKeyStr) == 0 { + return nil, errors.New("pubkey string is empty") + } + format := pubKeyStr[0] ybit := (format & 0x1) == 0x1 format &= ^byte(0x1)