Use size_t instead of int for RFC6979 outlen copy
What the developer wrote
Authored by John Moffett
Use size_t instead of int for RFC6979 outlen copy
If outlen is > INT_MAX, could trigger segfault or hang after copy
int now = outlen.
What changed, and why it matters
This commit fixes a variable type mismatch in the RFC6979 nonce-generation code. The code copies a `size_t` length value into an `int` variable. On platforms where `int` is 32 bits and `size_t` is 64 bits, requesting more than about 2 billion bytes of output would cause the `int` to wrap around to a negative value. That negative value would then be treated as a very large positive number in later comparisons, potentially causing the loop to run far too long or to access memory out of bounds, which could crash or hang the program. In practice, callers inside libsecp256k1 request only 32 bytes, so the bug is unlikely to be reachable from normal use.
Apply the patch. Review any external or downstream callers of `secp256k1_rfc6979_hmac_sha256_generate` to confirm they do not pass attacker-controlled lengths. Consider adding an explicit bounds check or assertion on `outlen` for defense in depth, even though the fix removes the immediate type mismatch.
Security signals we found
Integer width truncation from size_t to int
Potential signed/unsigned conversion defect leading to out-of-bounds or denial-of-service
Fix located in cryptographic nonce generation path (RFC6979 HMAC-SHA256)
No explicit security advisory or CVE referenced in commit materials
Evidence from the diff
In secp256k1_rfc6979_hmac_sha256_generate, the local variable now was declared as int but assigned from outlen, which is size_t. If outlen > INT_MAX, the conversion to int produces implementation-defined (typically negative) behavior. The subsequent if (now > outlen) now = outlen; would then see a negative int promoted to a large size_t, making now much larger than intended. This could cause excessive HMAC iterations, a hang, or an out-of-bounds write depending on how the caller uses the output. The patch changes int now to size_t now, eliminating the signedness/width mismatch. The function is internal and all known callers request small, fixed lengths (e.g., 32 bytes for nonce generation), so the overflow condition is not reachable in standard usage.
Changed components
src/hash_impl.hsecp256k1_rfc6979_hmac_sha256_generate functionInspect captured patch +1 / −1
diff --git a/src/hash_impl.h b/src/hash_impl.h
index 956e0ea..1065acd 100644
--- a/src/hash_impl.h
+++ b/src/hash_impl.h
@@ -265,7 +265,7 @@ static void secp256k1_rfc6979_hmac_sha256_generate(secp256k1_rfc6979_hmac_sha256
while (outlen > 0) {
secp256k1_hmac_sha256 hmac;
- int now = outlen;
+ size_t now = outlen;
secp256k1_hmac_sha256_initialize(&hmac, rng->k, 32);
secp256k1_hmac_sha256_write(&hmac, rng->v, 32);
secp256k1_hmac_sha256_finalize(&hmac, rng->v);
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.