fix: Add recovery ID check to secp256k1_recover syscall (#114)

NoirHQ · Jan 3, 2025 · 20d4f6e · 20d4f6e
1 parent 3847333
commit 20d4f6e
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/vendor/solana/programs/bpf_loader/src/syscalls/mod.rs b/vendor/solana/programs/bpf_loader/src/syscalls/mod.rs
@@ -882,6 +882,9 @@ declare_builtin_function!(
         let Ok(recovery_id) = recovery_id_val.try_into() else {
             return Ok(Secp256k1RecoverError::InvalidRecoveryId.into());
         };
+        if recovery_id > 3 {
+            return Ok(Secp256k1RecoverError::InvalidRecoveryId.into());
+        }
         if signature.len() != SECP256K1_SIGNATURE_LENGTH {
             return Ok(Secp256k1RecoverError::InvalidSignature.into());
         }