starsofchance/CVEfixes_v1.0.8 huggingface dataset:
CVE-2018-15861 (published 2018-08-25T21:29Z)

Unchecked NULL pointer usage in ExprResolveLhs in xkbcomp/expr.c in xkbcommon before 0.8.2 could be used by local attackers to crash (NULL pointer dereference) the xkbcommon parser by supplying a crafted keymap file that triggers an xkb_intern_atom failure.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/xkbcommon/libxkbcommon
commit_details: repo_url: https://github.com/xkbcommon/libxkbcommon
author: Daniel Stone
author_date: 2017-06-26 17:21:45+01:00
msg: xkbcomp: Don't falsely promise from ExprResolveLhs

Every user of ExprReturnLhs goes on to unconditionally dereference the
field return, which can be NULL if xkb_intern_atom fails. Return false
if this is the case, so we fail safely.

testcase: splice geometry data into interp

Signed-off-by: Daniel Stone <daniels@collabora.com>
repository: repo_url: https://github.com/xkbcommon/libxkbcommon
repo_name: xkbcommon/libxkbcommon
description: keymap handling library for toolkits and window systems
repo_language: C
owner: xkbcommon
file_changes: filename: expr.c
change_type: ModificationType.MODIFY
diff: @@ -42,7 +42,7 @@ ExprResolveLhs(struct xkb_context *ctx, const ExprDef *expr,
         *elem_rtrn = NULL;
         *field_rtrn = xkb_atom_text(ctx, expr->ident.ident);
         *index_rtrn = NULL;
-        return true;
+        return (*field_rtrn != NULL);
     case EXPR_FIELD_REF:
         *elem_rtrn = xkb_atom_text(ctx, expr->field_ref.element);
         *field_rtrn = xkb_atom_text(ctx, expr->field_ref.field);

programming_language: C
CVE-2020-12654 (published 2020-05-05T05:15Z)

An issue was found in Linux kernel before 5.5.4. mwifiex_ret_wmm_get_status() in drivers/net/wireless/marvell/mwifiex/wmm.c allows a remote AP to trigger a heap-based buffer overflow because of an incorrect memcpy, aka CID-3a9b153c5591.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:A/AC:H/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 7.1, HIGH (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Qing Xu
author_date: 2020-01-02 10:39:26+08:00
msg: mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()

mwifiex_ret_wmm_get_status() calls memcpy() without checking the
destination size.Since the source is given from remote AP which
contains illegal wmm elements , this may trigger a heap buffer
overflow.
Fix it by putting the length check before calling memcpy().

Signed-off-by: Qing Xu <m1s5p6688@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: wmm.c
change_type: ModificationType.MODIFY
diff: @@ -970,6 +970,10 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
 				    "WMM Parameter Set Count: %d\n",
 				    wmm_param_ie->qos_info_bitmap & mask);
 
+			if (wmm_param_ie->vend_hdr.len + 2 >
+				sizeof(struct ieee_types_wmm_parameter))
+				break;
+
 			memcpy((u8 *) &priv->curr_bss_params.bss_descriptor.
 			       wmm_ie, wmm_param_ie,
 			       wmm_param_ie->vend_hdr.len + 2);

programming_language: C
CVE-2017-14640 (published 2017-09-21T17:29Z)

A NULL pointer dereference was discovered in AP4_AtomSampleTable::GetSample in Core/Ap4AtomSampleTable.cpp in Bento4 version 1.5.0-617. The vulnerability causes a segmentation fault and application crash, which leads to remote denial of service.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/axiomatic-systems/Bento4
commit_details: repo_url: https://github.com/axiomatic-systems/Bento4
author: Gilles Boccon-Gibod
author_date: 2017-09-09 10:42:03-07:00
msg: fix for #183
repository: repo_url: https://github.com/axiomatic-systems/Bento4
repo_name: axiomatic-systems/Bento4
description: Full-featured MP4 format, MPEG DASH, HLS, CMAF SDK and tools
repo_language: C++
owner: axiomatic-systems
file_changes: filename: Ap4AtomSampleTable.cpp
change_type: ModificationType.MODIFY
diff: @@ -140,8 +140,10 @@ AP4_AtomSampleTable::GetSample(AP4_Ordinal index,
     AP4_UI32 cts_offset = 0;
     AP4_UI64 dts        = 0;
     AP4_UI32 duration   = 0;
-    result = m_SttsAtom->GetDts(index, dts, &duration);
-    if (AP4_FAILED(result)) return result;
+    if (m_SttsAtom) {
+        result = m_SttsAtom->GetDts(index, dts, &duration);
+        if (AP4_FAILED(result)) return result;
+    }
     sample.SetDuration(duration);
     sample.SetDts(dts);
     if (m_CttsAtom == NULL) {

programming_language: C++
CVE-2019-14430 (published 2019-08-20T14:15Z)

plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 5.3, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/YouPHPTube/YouPHPTube
commit_details: repo_url: https://github.com/YouPHPTube/YouPHPTube
author: daniel
author_date: 2019-07-26 11:32:32-03:00
repository: repo_url: https://github.com/YouPHPTube/YouPHPTube
repo_name: WWBN/AVideo
description: Create Your Own Broadcast Network With AVideo Platform Open-Source. OAVP OVP
repo_language: JavaScript
owner: YouPHPTube
file_changes: filename: AuditTable.php
change_type: ModificationType.MODIFY
diff: @@ -22,7 +22,7 @@ class AuditTable extends ObjectYPT {
         $this->class = $class;
         $this->statement = substr(str_replace("'", "", $statement),0,1000)."n";
         $this->formats = $formats;
-        $this->values = $values;
+        $this->values = str_replace(array("'","\\"), array("",""), $values);
         $this->ip = getRealIpAddr();
         $this->users_id = empty($users_id)?"NULL":$users_id;
         return $this->save();

programming_language: PHP
CVE-2024-38361 (published 2024-06-20T23:15Z)

Spicedb is an Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications. Use of an exclusion under an arrow that has multiple resources may resolve to `NO_PERMISSION` when permission is expected. If the resource exists under *multiple* folders and the user has access to view more than a single folder, SpiceDB may report the user does not have access due to a failure in the exclusion dispatcher to request that *all* the folders in which the user is a member be returned. Permission is returned as `NO_PERMISSION` when `PERMISSION` is expected on the `CheckPermission` API. This issue has been addressed in version 1.33.1. All users are advised to upgrade. There are no known workarounds for this issue.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/authzed/spicedb
commit_details: repo_url: https://github.com/authzed/spicedb
author: Joseph Schorr
author_date: 2024-06-20 11:33:19-04:00
msg: Merge pull request from GHSA-grjv-gjgr-66g2

Fix exclusion operation in Check dispatch to *always* request the full set of results for the first branch
repository: repo_url: https://github.com/authzed/spicedb
repo_name: authzed/spicedb
description: Open Source, Google Zanzibar-inspired permissions database to enable fine-grained authorization for customer applications
repo_language: Go
owner: authzed
CVE-2017-5594 (published 2017-01-25T18:59Z)

An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-640
cwe_name: Weak Password Recovery Mechanism for Forgotten Password
description: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
extended_description: 
            It is common for an application to have a mechanism that provides a means for a user to gain access to their account in the event they forget their password. Very often the password recovery mechanism is weak, which has the effect of making it more likely that it would be possible for a person other than the legitimate system user to gain access to that user's account. Weak password recovery schemes completely undermine a strong password authentication scheme.
            This weakness may be that the security question is too easy to guess or find an answer to (e.g. because the question is too common, or the answers can be found using social media). Or there might be an implementation weakness in the password recovery mechanism code that may for instance trick the system into e-mailing the new password to an e-mail account other than that of the user. There might be no throttling done on the rate of password resets so that a legitimate user can be denied service by an attacker if an attacker tries to recover their password in a rapid succession. The system may send the original password to the user rather than generating a new temporary password. In summary, password recovery functionality, if not carefully designed and implemented can often become the system's weakest link that can be misused in a way that would allow an attacker to gain unauthorized access to the system.
         
         

Fix information:
repo_url: https://github.com/pagekit/pagekit
commit_details: repo_url: https://github.com/pagekit/pagekit
author: Malte
author_date: 2017-01-20 14:15:58+01:00
msg: Merge branch 'release/1.0.11'
repository: repo_url: https://github.com/pagekit/pagekit
repo_name: pagekit/pagekit
description: Pagekit CMS
repo_language: PHP
owner: pagekit
CVE-2018-1999013 (published 2018-07-23T15:29Z)

FFmpeg before commit a7e032a277452366771951e29fd0bf2bd5c029f0 contains a use-after-free vulnerability in the realmedia demuxer that can result in vulnerability allows attacker to read heap memory. This attack appear to be exploitable via specially crafted RM file has to be provided as input. This vulnerability appears to have been fixed in a7e032a277452366771951e29fd0bf2bd5c029f0 and later.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-416
cwe_name: Use After Free
description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
extended_description: 
             
             
             
			 
             
             
         
         

Fix information:
repo_url: https://github.com/FFmpeg/FFmpeg
commit_details: repo_url: https://github.com/FFmpeg/FFmpeg
author: Michael Niedermayer
author_date: 2018-07-03 21:37:46+02:00
msg: avformat/rmdec: Do not pass mime type in rm_read_multi() to ff_rm_read_mdpr_codecdata()

Fixes: use after free()
Fixes: rmdec-crash-ffe85b4cab1597d1cfea6955705e53f1f5c8a362

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
repository: repo_url: https://github.com/FFmpeg/FFmpeg
repo_name: FFmpeg/FFmpeg
description: Mirror of https://git.ffmpeg.org/ffmpeg.git
repo_language: C
owner: FFmpeg
file_changes: filename: rmdec.c
change_type: ModificationType.MODIFY
diff: @@ -522,7 +522,7 @@ static int rm_read_multi(AVFormatContext *s, AVIOContext *pb,
 
         size2 = avio_rb32(pb);
         ret = ff_rm_read_mdpr_codecdata(s, s->pb, st2, st2->priv_data,
-                                        size2, mime);
+                                        size2, NULL);
         if (ret < 0)
             return ret;
     }

programming_language: C
CVE-2022-21164 (published 2022-03-16T16:15Z)

The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/Venemo/node-lmdb
commit_details: repo_url: https://github.com/Venemo/node-lmdb
author: Kris Zyp
author_date: 2022-03-12 07:19:20-07:00
msg: Perform argument check for putString
repository: repo_url: https://github.com/Venemo/node-lmdb
repo_name: Venemo/node-lmdb
description: Node.js binding for lmdb
repo_language: C++
owner: Venemo
file_changes: filename: txn.cpp
change_type: ModificationType.MODIFY
diff: @@ -295,6 +295,8 @@ Nan::NAN_METHOD_RETURN_TYPE TxnWrap::putCommon(Nan::NAN_METHOD_ARGS_TYPE info, v
 }
 
 NAN_METHOD(TxnWrap::putString) {
+    if (!info[2]->IsString())
+        return Nan::ThrowError("Value must be a string.");
     return putCommon(info, [](Nan::NAN_METHOD_ARGS_TYPE info, MDB_val &data) -> void {
         CustomExternalStringResource::writeTo(Local<String>::Cast(info[2]), &data);
     }, [](MDB_val &data) -> void {

programming_language: C++
CVE-2018-1068 (published 2018-03-16T16:29Z)

A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory.

Severity: HIGH
CVSS v2 base score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CVSS v3 base score: 6.7, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/torvalds/linux
commit_details: repo_url: https://github.com/torvalds/linux
author: Florian Westphal
author_date: 2018-02-19 01:24:15+01:00
msg: netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets

We need to make sure the offsets are not out of range of the
total size.
Also check that they are in ascending order.

The WARN_ON triggered by syzkaller (it sets panic_on_warn) is
changed to also bail out, no point in continuing parsing.

Briefly tested with simple ruleset of
-A INPUT --limit 1/s' --log
plus jump to custom chains using 32bit ebtables binary.

Reported-by: <syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
repository: repo_url: https://github.com/torvalds/linux
repo_name: torvalds/linux
description: Linux kernel source tree
repo_language: C
owner: torvalds
file_changes: filename: ebtables.c
change_type: ModificationType.MODIFY
diff: @@ -2060,7 +2060,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32,
 		if (match_kern)
 			match_kern->match_size = ret;
 
-		WARN_ON(type == EBT_COMPAT_TARGET && size_left);
+		if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
+			return -EINVAL;
+
 		match32 = (struct compat_ebt_entry_mwt *) buf;
 	}
 
@@ -2116,6 +2118,15 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base,
 	 *
 	 * offsets are relative to beginning of struct ebt_entry (i.e., 0).
 	 */
+	for (i = 0; i < 4 ; ++i) {
+		if (offsets[i] >= *total)
+			return -EINVAL;
+		if (i == 0)
+			continue;
+		if (offsets[i-1] > offsets[i])
+			return -EINVAL;
+	}
+
 	for (i = 0, j = 1 ; j < 4 ; j++, i++) {
 		struct compat_ebt_entry_mwt *match32;
 		unsigned int size;

programming_language: C
CVE-2020-36560 (published 2022-12-27T22:15Z)

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

CVSS v3 base score: 9.1, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/artdarek/go-unzip
commit_details: repo_url: https://github.com/artdarek/go-unzip
author: Dariusz Prząda
author_date: 2020-03-08 08:20:38+01:00
msg: Merge pull request #2 from snoopysecurity/fix/santize-filename-paths

fix: sanitize filepath names
repository: repo_url: https://github.com/artdarek/go-unzip
repo_name: artdarek/go-unzip
description: Simple GOLang unzip package
repo_language: Go
owner: artdarek
CVE-2021-32135 (published 2021-09-13T15:15Z)

The trak_box_size function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CVSS v3 base score: 5.5, MEDIUM (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-476
cwe_name: NULL Pointer Dereference
description: The product dereferences a pointer that it expects to be valid but is NULL.
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/gpac/gpac
commit_details: repo_url: https://github.com/gpac/gpac
author: jeanlf
author_date: 2021-04-23 14:37:01+02:00
msg: fixed #1757
repository: repo_url: https://github.com/gpac/gpac
repo_name: gpac/gpac
description: GPAC Ultramedia OSS for Video Streaming & Next-Gen Multimedia Transcoding, Packaging & Delivery
repo_language: C
owner: gpac
file_changes: filename: box_code_base.c
change_type: ModificationType.MODIFY
diff: @@ -6743,6 +6743,8 @@ GF_Err trak_box_size(GF_Box *s)
 	GF_TrackBox *ptr = (GF_TrackBox *)s;
 
 	if (ptr->sample_encryption && ptr->sample_encryption->load_needed) {
+		if (!ptr->moov || !!ptr->moov->mov || !ptr->moov->mov->movieFileMap)
+			return GF_ISOM_INVALID_FILE;
 		GF_Err e = senc_Parse(ptr->moov->mov->movieFileMap->bs, ptr, NULL, ptr->sample_encryption);
 		if (e) return e;
 	}

programming_language: C
CVE-2021-43572 (published 2021-11-09T22:15Z)

The verify function in the Stark Bank Python ECDSA library (aka starkbank-escada or ecdsa-python) before 2.0.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-347
cwe_name: Improper Verification of Cryptographic Signature
description: The product does not verify, or incorrectly verifies, the cryptographic signature for data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/starkbank/ecdsa-python
commit_details: repo_url: https://github.com/starkbank/ecdsa-python
author: Caio Dottori
author_date: 2021-11-04 18:07:55-03:00
msg: Add signature.r and signature.s range check
repository: repo_url: https://github.com/starkbank/ecdsa-python
repo_name: starkbank/ecdsa-python
description: A lightweight and fast pure Python ECDSA library
repo_language: Python
owner: starkbank
file_changes: filename: CHANGELOG.md
change_type: ModificationType.MODIFY
diff: @@ -13,6 +13,8 @@ Given a version number MAJOR.MINOR.PATCH, increment:
 
 
 ## [Unreleased]
+### Fixed
+- Signature r and s range check
 
 ## [2.0.0] - 2021-10-08
 ### Added

programming_language: Markdown
filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
-from ellipticcurve.utils.compatibility import *
-from ellipticcurve.privateKey import PrivateKey
-from ellipticcurve.publicKey import PublicKey
-from ellipticcurve.signature import Signature
-from ellipticcurve.utils.file import File
-from ellipticcurve.ecdsa import Ecdsa
+from .utils.compatibility import *
+from .privateKey import PrivateKey
+from .publicKey import PublicKey
+from .signature import Signature
+from .utils.file import File
+from .ecdsa import Ecdsa

programming_language: Python
filename: ecdsa.py
change_type: ModificationType.MODIFY
diff: @@ -33,6 +33,10 @@ class Ecdsa:
         curve = publicKey.curve
         r = signature.r
         s = signature.s
+        if not 1 <= r <= curve.N - 1:
+            return False
+        if not 1 <= s <= curve.N - 1:
+            return False
         inv = Math.inv(s, curve.N)
         u1 = Math.multiply(curve.G, n=(numberMessage * inv) % curve.N, N=curve.N, A=curve.A, P=curve.P)
         u2 = Math.multiply(publicKey.point, n=(r * inv) % curve.N, N=curve.N, A=curve.A, P=curve.P)

programming_language: Python