Add some missing bounds checks in signature verification routines.

[u/mdw/putty] / sshrsa.c

diff --git a/sshrsa.c b/sshrsa.c
index 7fb9694..c4a469e 100644 (file)
--- a/sshrsa.c
+++ b/sshrsa.c
@@ -842,6 +842,8 @@ static int rsa2_verifysig(void *key, char *sig, int siglen,
        return 0;
     }
     in = getmp(&sig, &siglen);
+    if (!in)
+        return 0;
     out = modpow(in, rsa->exponent, rsa->modulus);
     freebn(in);