From 1de3864ff9f6d9c7ef0c1e30f0d715f0e6f8cc46 Mon Sep 17 00:00:00 2001
From: DarkWindman <mazylia6@gmail.com>
Date: Mon, 10 Aug 2026 14:35:05 +0300
Subject: [PATCH] bppp: check for overflow in generator allocation

---
 src/modules/bppp/main_impl.h  | 5 +++++
 src/modules/bppp/tests_impl.h | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/src/modules/bppp/main_impl.h b/src/modules/bppp/main_impl.h
index 8c4d1eab..bc7c281b 100644
--- a/src/modules/bppp/main_impl.h
+++ b/src/modules/bppp/main_impl.h
@@ -28,6 +28,11 @@ secp256k1_bppp_generators *secp256k1_bppp_generators_create(const secp256k1_cont
     if (ret == NULL) {
         return NULL;
     }
+    /* Ensure that multiplication will not wrap around */
+    if (n > SIZE_MAX / sizeof(*ret->gens)) {
+        free(ret);
+        return NULL;
+    }
     ret->gens = checked_malloc(&ctx->error_callback, n * sizeof(*ret->gens));
     if (ret->gens == NULL) {
         free(ret);
diff --git a/src/modules/bppp/tests_impl.h b/src/modules/bppp/tests_impl.h
index 47a00c6d..0c5ed1e9 100644
--- a/src/modules/bppp/tests_impl.h
+++ b/src/modules/bppp/tests_impl.h
@@ -28,6 +28,8 @@ static void test_bppp_generators_api(void) {
     CHECK(gens != NULL);
     gens_orig = gens; /* Preserve for round-trip test */
 
+    CHECK(secp256k1_bppp_generators_create(CTX, SIZE_MAX / sizeof(secp256k1_ge) + 1) == NULL);
+
     /* Serialize */
     CHECK_ILLEGAL(CTX, secp256k1_bppp_generators_serialize(CTX, NULL, gens_ser, &len));
     CHECK_ILLEGAL(CTX, secp256k1_bppp_generators_serialize(CTX, gens, NULL, &len));