Fix curve448

LinuxJedi · LinuxJedi · commit 180c66ba70d8 · 2026-02-16T15:56:41.000Z
`wc_curve448_check_public` can get into an infinite loop in the
big-endian code path.
diff --git a/wolfcrypt/src/curve448.c b/wolfcrypt/src/curve448.c
@@ -409,12 +409,12 @@ int wc_curve448_check_public(const byte* pub, word32 pubSz, int endian)
                 return ECC_BAD_ARG_E;
             }
             if ((i == 27) && (pub[i] == 0xfe)) {
-                for (++i; i < CURVE448_PUB_KEY_SIZE - 1; i--) {
+                for (++i; i < CURVE448_PUB_KEY_SIZE - 1; i++) {
                     if (pub[i] != 0xff) {
                         break;
                     }
                 }
-                if ((i == CURVE448_PUB_KEY_SIZE) && (pub[i] >= 0xfe)) {
+                if ((i == CURVE448_PUB_KEY_SIZE - 1) && (pub[i] >= 0xfe)) {
                     return ECC_BAD_ARG_E;
                 }
             }

Original file line number	Diff line number	Diff line change
`@@ -409,12 +409,12 @@ int wc_curve448_check_public(const byte* pub, word32 pubSz, int endian)`
`409`	`409`	`return ECC_BAD_ARG_E;`
`410`	`410`	`}`
`411`	`411`	`if ((i == 27) && (pub[i] == 0xfe)) {`
`412`		`- for (++i; i < CURVE448_PUB_KEY_SIZE - 1; i--) {`
	`412`	`+ for (++i; i < CURVE448_PUB_KEY_SIZE - 1; i++) {`
`413`	`413`	`if (pub[i] != 0xff) {`
`414`	`414`	`break;`
`415`	`415`	`}`
`416`	`416`	`}`
`417`		`- if ((i == CURVE448_PUB_KEY_SIZE) && (pub[i] >= 0xfe)) {`
	`417`	`+ if ((i == CURVE448_PUB_KEY_SIZE - 1) && (pub[i] >= 0xfe)) {`
`418`	`418`	`return ECC_BAD_ARG_E;`
`419`	`419`	`}`
`420`	`420`	`}`