Re: [PATCH] crypto: lib/mpi - Fix integer underflow in mpi_read_raw_from_sgl()

[Lukas Wunner <lukas@wunner.de>]

On Sun, Apr 12, 2026 at 04:19:47PM +0200, Lukas Wunner wrote:
> Yiming reports an integer underflow in mpi_read_raw_from_sgl() when
> subtracting "lzeros" from the unsigned "nbytes".
[...]
> +++ b/lib/crypto/mpi/mpicoder.c
> @@ -347,7 +347,7 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
>  	lzeros = 0;
>  	len = 0;
>  	while (nbytes > 0) {
> -		while (len && !*buff) {
> +		while (len && !*buff && lzeros < nbytes) {
>  			lzeros++;
>  			len--;
>  			buff++;

As a side note, in 2018, commit 8a2a0dd35f2e ("crypto: caam - strip
input zeros from RSA input buffer") copy-pasted a large portion of
mpi_read_raw_from_sgl() into caam_rsa_count_leading_zeros() and
duplicated the bug as well.

One year later, commit c3725f7ccc8c ("crypto: caam - fix
pkcs1pad(rsa-caam, sha256) failure because of invalid input")
fixed the bug in the duplicated function, but unfortunately not
in the original mpi_read_raw_from_sgl().  The fix was identical
to the one I'm proposing above.

Thanks,

Lukas