From 751b89fde0d487a854e6fdf8171669e89cfab89b Mon Sep 17 00:00:00 2001
From: Mark Karpeles <magicaltux@gmail.com>
Date: Mon, 15 Jun 2026 01:13:12 +0900
Subject: [PATCH] Add input check to mp_unpack

When nails >= size*8 the size - nail_bytes count underflowed, leading
to an out-of-bounds read of the input buffer.
---
 mp_unpack.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mp_unpack.c b/mp_unpack.c
index f0127fa44..41e4cbde8 100644
--- a/mp_unpack.c
+++ b/mp_unpack.c
@@ -13,6 +13,10 @@ mp_err mp_unpack(mp_int *rop, size_t count, mp_order order, size_t size,
    size_t odd_nails, nail_bytes, i, j;
    uint8_t odd_nail_mask;
 
+   if ((size == 0u) || (nails >= (size * 8u))) {
+      return MP_VAL;
+   }
+
    mp_zero(rop);
 
    if (endian == MP_NATIVE_ENDIAN) {