ringct: prevent a potential very large allocation

Reported by QuarksLab.
This commit is contained in:
moneromooo-monero 2018-07-24 21:23:08 +01:00
parent a4317e61b5
commit 61632dc166
No known key found for this signature in database
GPG key ID: 686F07454D6CEFC3

View file

@ -317,9 +317,9 @@ namespace rct {
ar.begin_array();
uint32_t nbp = bulletproofs.size();
FIELD(nbp)
PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs);
if (bulletproofs.size() > outputs)
if (nbp > outputs)
return false;
PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs);
for (size_t i = 0; i < nbp; ++i)
{
FIELDS(bulletproofs[i])