Explorar o código

LibCrypto: Fix an out-of-bounds access in UnsignedBigInteger

This is working fine for TLS because we have a big enough inline
capacity, but in theory we could have crashed at any time even with
our 512 words of inline capacity.
DexesTTP %!s(int64=4) %!d(string=hai) anos
pai
achega
0853d98420

+ 1 - 1
Userland/Libraries/LibCrypto/BigInt/UnsignedBigInteger.cpp

@@ -248,7 +248,7 @@ void UnsignedBigInteger::set_bit_inplace(size_t bit_index)
     const size_t word_index = bit_index / UnsignedBigInteger::BITS_IN_WORD;
     const size_t word_index = bit_index / UnsignedBigInteger::BITS_IN_WORD;
     const size_t inner_word_index = bit_index % UnsignedBigInteger::BITS_IN_WORD;
     const size_t inner_word_index = bit_index % UnsignedBigInteger::BITS_IN_WORD;
 
 
-    m_words.ensure_capacity(word_index);
+    m_words.ensure_capacity(word_index + 1);
 
 
     for (size_t i = length(); i <= word_index; ++i) {
     for (size_t i = length(); i <= word_index; ++i) {
         m_words.unchecked_append(0);
         m_words.unchecked_append(0);