Skip to content

implement audit suggestions#635

Open
perturbing wants to merge 5 commits intomasterfrom
perturbing/audit-fix
Open

implement audit suggestions#635
perturbing wants to merge 5 commits intomasterfrom
perturbing/audit-fix

Conversation

@perturbing
Copy link
Member

@perturbing perturbing commented Mar 10, 2026

Description

This PR fixes five things,

  1. It adds a termination null pointer to the AffineArrayPtr construction in withAffineBlockArrayPtr. This aligns now with how withPointArray and withScalarArray do it. Note that even though the blst functions rely on the number of points passed as an argument, it is good to add this, as it is good practice.

  2. It fixed the memcmp ffi import, which was incorrectly using CSize (unsigned int). Note that the return value of memcmp is a signed integer here. Since we used this function only in

eqAffinePtr :: forall curve. BLS curve => AffinePtr curve -> AffinePtr curve -> IO Bool
eqAffinePtr (AffinePtr a) (AffinePtr b) =
  (== 0) <$> c_memcmp (castPtr a) (castPtr b) (sizeAffine_ (Proxy @curve))

Where the sign did not matter, it did not cause problems.

  1. Use CBool instead of Bool in the FFI calls

  2. Serialization of PoP bytes should reject the zero point in the group (point at infinity)

  3. Add the PoP Cipher suite as per the IETF draft (plus a comment on usage).

Checklist

  • Commit sequence broadly makes sense and commits have useful messages
  • New tests are added if needed and existing tests are updated
  • All visible changes are prepended to the latest section of a CHANGELOG.md for the affected packages.
    New section is never added with the code changes. (See RELEASING.md)
  • When applicable, versions are updated in .cabal and CHANGELOG.md files according to the
    versioning process.
  • The version bounds in .cabal files for all affected packages are updated.
    If you change the bounds in a cabal file, that package itself must have a version increase. (See RELEASING.md)
  • Self-reviewed the diff

@perturbing perturbing requested a review from lehins as a code owner March 10, 2026 10:25
@perturbing perturbing force-pushed the perturbing/audit-fix branch from 7813782 to 9f394d8 Compare March 16, 2026 18:59
@perturbing perturbing force-pushed the perturbing/audit-fix branch from 9f394d8 to e9d3d22 Compare March 24, 2026 09:43
@perturbing perturbing changed the title implement audit suggestions - batch 1 implement audit suggestions Mar 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants