crypto: add IsOnCurve check (#13627)

Fixes [CVE-2025-24883](https://nvd.nist.gov/vuln/detail/CVE-2025-24883) See ethereum/go-ethereum#31100
erigontech · Jan 30, 2025 · 44732ef · 44732ef
1 parent b95a16d
commit 44732ef
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/erigon-lib/crypto/crypto.go b/erigon-lib/crypto/crypto.go
@@ -189,6 +189,9 @@ func UnmarshalPubkeyStd(pub []byte) (*ecdsa.PublicKey, error) {
 	if x == nil {
 		return nil, errInvalidPubkey
 	}
+	if !S256().IsOnCurve(x, y) {
+		return nil, errInvalidPubkey
+	}
 	return &ecdsa.PublicKey{Curve: S256(), X: x, Y: y}, nil
 }