Merge #1673: Assert field magnitude at control-flow join

jonasnick · jonasnick · commit 92394476e9b2 · 2025-05-24T05:51:11.000Z
3a4f448 Assert field magnitude at control-flow join (Peter.Dettman) Pull request description: ACKs for top commit: sipa: ACK 3a4f448 jonasnick: ACK 3a4f448 Tree-SHA512: b78b500458597104a1d76985b0b619886f6dc2a4b136ca7ee37823796c8920041459b5674985bb4e1cc93ee7be5a702f6a84f8e5ddd25b97da6babacf0f34c0e
diff --git a/src/ecmult_const_impl.h b/src/ecmult_const_impl.h
@@ -373,6 +373,8 @@ static int secp256k1_ecmult_const_xonly(secp256k1_fe* r, const secp256k1_fe *n,
         }
     }
 
+    SECP256K1_FE_VERIFY_MAGNITUDE(&g, 2);
+
     /* Compute base point P = (n*g, g^2), the effective affine version of (n*g, g^2, v), which has
      * corresponding affine X coordinate n/d. */
     secp256k1_fe_mul(&p.x, &g, n);

Original file line number	Diff line number	Diff line change
`@@ -373,6 +373,8 @@ static int secp256k1_ecmult_const_xonly(secp256k1_fe* r, const secp256k1_fe *n,`
`373`	`373`	`}`
`374`	`374`	`}`
`375`	`375`
	`376`	`+ SECP256K1_FE_VERIFY_MAGNITUDE(&g, 2);`
	`377`	`+`
`376`	`378`	`/* Compute base point P = (ng, g^2), the effective affine version of (ng, g^2, v), which has`
`377`	`379`	`* corresponding affine X coordinate n/d. */`
`378`	`380`	`secp256k1_fe_mul(&p.x, &g, n);`