From 0588f9b2eed9ae38883806d754bdd879823038cf Mon Sep 17 00:00:00 2001
From: Mark Wooding <mdw@distorted.org.uk>
Date: Sat, 29 Jul 2017 01:02:46 +0100
Subject: [PATCH] base/keysz.c: Fix bogus pointer dereference on wide-arg key
 size lists.

I must have been seriously short on brain that day.
---
 base/keysz.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/base/keysz.c b/base/keysz.c
index 48c965e3..8e5e2caf 100644
--- a/base/keysz.c
+++ b/base/keysz.c
@@ -56,7 +56,7 @@ size_t keysz(size_t sz, const octet *ksz)
   unsigned t, u, v;
 
   ksz++;
-#define ARG(i) (wd == 1 ? ksz[i] : LOAD16(2*i))
+#define ARG(i) (wd == 1 ? ksz[i] : LOAD16(ksz + 2*i))
   if (sz == 0)
     return (ARG(0));
   else switch (op) {
-- 
2.11.0