Fix buffer overrun in SRP (#7484)

red-001 · nerzhul · commit 7bdf5eae05f6 · 2018-06-26T10:02:26.000+02:00
The old code got a pointer to the array instead of the first element, this resulted in a buffer overflow when the function was used more than once.
diff --git a/src/util/srp.cpp b/src/util/srp.cpp
@@ -613,7 +613,7 @@ SRP_Result srp_create_salted_verification_key( SRP_HashAlgorithm alg,
 			if (fill_buff() != SRP_OK) goto error_and_exit;
 		*bytes_s = (unsigned char *)srp_alloc(size_to_fill);
 		if (!*bytes_s) goto error_and_exit;
-		memcpy(*bytes_s, &g_rand_buff + g_rand_idx, size_to_fill);
+		memcpy(*bytes_s, &g_rand_buff[g_rand_idx], size_to_fill);
 		g_rand_idx += size_to_fill;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -613,7 +613,7 @@ SRP_Result srp_create_salted_verification_key( SRP_HashAlgorithm alg,`
`613`	`613`	`if (fill_buff() != SRP_OK) goto error_and_exit;`
`614`	`614`	`bytes_s = (unsigned char )srp_alloc(size_to_fill);`
`615`	`615`	`if (!*bytes_s) goto error_and_exit;`
`616`		`- memcpy(*bytes_s, &g_rand_buff + g_rand_idx, size_to_fill);`
	`616`	`+ memcpy(*bytes_s, &g_rand_buff[g_rand_idx], size_to_fill);`
`617`	`617`	`g_rand_idx += size_to_fill;`
`618`	`618`	`}`
`619`	`619`