EC key pair import: check the buffer size
When importing a private elliptic curve key, require the input to have
exactly the right size. RFC 5915 requires the right size (you aren't
allow to omit leading zeros). A different buffer size likely means
that something is wrong, e.g. a mismatch between the declared key type
and the actual data.
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 6a4f180..38977cf 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -621,6 +621,9 @@
mbedtls_ecp_keypair *ecp = NULL;
mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
+ if( PSA_BITS_TO_BYTES( PSA_ECC_CURVE_BITS( curve ) ) != data_length )
+ return( PSA_ERROR_INVALID_ARGUMENT );
+
*p_ecp = NULL;
ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
if( ecp == NULL )