From 0b734963db125474f5b14561548da4bbebaf51b9 Mon Sep 17 00:00:00 2001 From: Frank Denis Date: Tue, 31 Oct 2017 16:09:43 +0100 Subject: [PATCH] edwards25519sha512batch_open(): check order before decoding instead of after --- src/libsodium/crypto_sign/ed25519/ref10/obsolete.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c b/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c index c77c6500..afeb5a9c 100644 --- a/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c +++ b/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c @@ -90,8 +90,8 @@ crypto_sign_edwards25519sha512batch_open(unsigned char *m, if (sm[smlen - 1] & 224) { return -1; } - if (ge_frombytes_negate_vartime(&A, pk) != 0 || ge_has_small_order(pk) != 0 || - ge_frombytes_negate_vartime(&R, sm) != 0 || ge_has_small_order(sm) != 0) { + if (ge_has_small_order(pk) != 0 || ge_frombytes_negate_vartime(&A, pk) != 0 || + ge_has_small_order(sm) != 0 || ge_frombytes_negate_vartime(&R, sm) != 0) { return -1; } ge_p3_to_cached(&Ai, &A);