Program crashed at mbedtls_mpi_copy

[AitMub]

---

Description

• Type: Bug
• Priority: Minor

---

Bug

Summary
The program crashed at mbedtls_mpi_copy.

OS
Windows

Mbed TLS build:
Version: 2.8.5
OS version: Windows 11 Chinese (Simplified) Version 26100

Additional environment information: The library is used by Unity2022.3.16 for WebRequest

Expected behavior
The program should correctly execute the mbedtls_mpi_inv_mod function.

Actual behavior
The program crashed when writing the result to X at MBEDTLS_MPI_CHK(mbedtls_mpi_copy(X, &V1)). X->p is an invalid address.

static int ecp_normalize_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt)
{
   ...
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
    mbedtls_mpi Zi, ZZi; // Both Zi and ZZi became invalid, their n and p became 0x11068e3c8

    mbedtls_mpi_init(&Zi); mbedtls_mpi_init(&ZZi);

    /*
     * X = X / Z^2 mod p
     */
    MBEDTLS_MPI_CHK(mbedtls_mpi_inv_mod(&Zi, &pt->Z, &grp->P));

stacktrace

configs.zip

[davidhorstmann-arm]

Hi, thanks for this report!

Because this is in a third party integration of Mbed TLS, where we don't have access to the source code, I'm afraid we can't reproduce or debug it. If you can create a minimal reproducer and supply the code, we can try to find the problem, but otherwise we don't know if the problem is caused by Mbed TLS or Unity.

[AitMub]

Hi, thanks for this report!

Because this is in a third party integration of Mbed TLS, where we don't have access to the source code, I'm afraid we can't reproduce or debug it. If you can create a minimal reproducer and supply the code, we can try to find the problem, but otherwise we don't know if the problem is caused by Mbed TLS or Unity.

Thank you for your reply!

This crash has occurred only once so far, and unfortunately, I haven’t been able to reproduce it. It's a bit difficult to pinpoint the exact cause at the moment. I'll keep an eye out for any further occurrences and let you know if I can gather more details.