From ad3004ec8731730e93fcfbbc824e67eadc1c1bae Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Mon, 29 Dec 2025 23:22:15 +0100
Subject: [PATCH] core_ed25519_is_valid_point: check Y==Z in addition to X==0

---
 src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c | 5 ++++-
 test/default/core_ed25519.c                             | 7 ++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
index d3020132..4b824f6d 100644
--- a/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
+++ b/src/libsodium/crypto_core/ed25519/ref10/ed25519_ref10.c
@@ -1141,10 +1141,13 @@ int
 ge25519_is_on_main_subgroup(const ge25519_p3 *p)
 {
     ge25519_p3 pl;
+    fe25519    t;
 
     ge25519_mul_l(&pl, p);
 
-    return fe25519_iszero(pl.X);
+    fe25519_sub(t, pl.Y, pl.Z);
+
+    return fe25519_iszero(pl.X) & fe25519_iszero(t);
 }
 
 int
diff --git a/test/default/core_ed25519.c b/test/default/core_ed25519.c
index bc457493..02f72bd6 100644
--- a/test/default/core_ed25519.c
+++ b/test/default/core_ed25519.c
@@ -13,6 +13,10 @@ static const unsigned char max_canonical_p[32] = {
     0xe4, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
     0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f
 };
+static const unsigned char not_main_subgroup_p[32] = {
+    0x95, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99,
+    0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99, 0x99
+};
 static const unsigned char L_p1[32] = {
     0xee, 0xd3, 0xf5, 0x5c, 0x1a, 0x63, 0x12, 0x58, 0xd6, 0x9c, 0xf7, 0xa2, 0xde, 0xf9, 0xde, 0x14,
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10
@@ -133,11 +137,12 @@ main(void)
     assert(crypto_core_ed25519_is_valid_point(p) == 0);
 
     p[0] = 9;
-    assert(crypto_core_ed25519_is_valid_point(p) == 1);
+    assert(crypto_core_ed25519_is_valid_point(p) == 0);
 
     assert(crypto_core_ed25519_is_valid_point(max_canonical_p) == 1);
     assert(crypto_core_ed25519_is_valid_point(non_canonical_invalid_p) == 0);
     assert(crypto_core_ed25519_is_valid_point(non_canonical_p) == 0);
+    assert(crypto_core_ed25519_is_valid_point(not_main_subgroup_p) == 0);
 
     memcpy(p2, p, crypto_core_ed25519_BYTES);
     add_P(p2);