From bd4aacf078b2511b1a34d29b2550a7561bd94c3a Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Fri, 24 Jan 2014 09:36:21 -0800
Subject: [PATCH] =?UTF-8?q?crypto=5Fsign=5Fed25519=5Fopen():=20Check=20tha?=
 =?UTF-8?q?t=20the=20public=20key=20is=20not=20all=20zeroes.=20Reported=20?=
 =?UTF-8?q?by=20Mikkel=20Fahn=C3=B8e=20J=C3=B8rgensen=20via=20nightcracker?=
 =?UTF-8?q?@?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/libsodium/crypto_sign/ed25519/ref10/open.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/libsodium/crypto_sign/ed25519/ref10/open.c b/src/libsodium/crypto_sign/ed25519/ref10/open.c
index 7e30bfc1..1c32c437 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/open.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/open.c
@@ -10,6 +10,7 @@ int crypto_sign_open(
   const unsigned char *pk
 )
 {
+  unsigned char d = 0;
   unsigned char h[64];
   unsigned char checkr[32];
   ge_p3 A;
@@ -20,6 +21,8 @@ int crypto_sign_open(
   if (smlen < 64) return -1;
   if (sm[63] & 224) return -1;
   if (ge_frombytes_negate_vartime(&A,pk) != 0) return -1;
+  for (i = 0; i < 32; ++i) d ^= pk[i];
+  if (d == 0) return -1;
 
   for (i = 0;i < smlen;++i) m[i] = sm[i];
   for (i = 0;i < 32;++i) m[32 + i] = pk[i];