From 43fca0ff5594c1f25ef0ce63556b2ed344282190 Mon Sep 17 00:00:00 2001 From: Tim Ruffing Date: Mon, 23 Mar 2026 16:52:56 +0100 Subject: [PATCH] ecdsa: VERIFY_CHECK result of _fe_set_b32_limit This also avoids a spurious "-Wmaybe-uninitialized" warning emitted by gcc 16 (snapshot) when compiling with -DDETERMINISTIC. --- src/ecdsa_impl.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/ecdsa_impl.h b/src/ecdsa_impl.h index ce36e85e..163539eb 100644 --- a/src/ecdsa_impl.h +++ b/src/ecdsa_impl.h @@ -196,6 +196,7 @@ static int secp256k1_ecdsa_sig_verify(const secp256k1_scalar *sigr, const secp25 unsigned char c[32]; secp256k1_scalar sn, u1, u2; #if !defined(EXHAUSTIVE_TEST_ORDER) + int range; secp256k1_fe xr; #endif secp256k1_gej pubkeyj; @@ -226,9 +227,16 @@ static int secp256k1_ecdsa_sig_verify(const secp256k1_scalar *sigr, const secp25 return secp256k1_scalar_eq(sigr, &computed_r); } #else + + /* Interpret sigr as a field element xr */ secp256k1_scalar_get_b32(c, sigr); - /* we can ignore the fe_set_b32_limit return value, because we know the input is in range */ - (void)secp256k1_fe_set_b32_limit(&xr, c); + range = secp256k1_fe_set_b32_limit(&xr, c); +#ifdef VERIFY + /* We know that c is in range; it comes from a scalar. */ + VERIFY_CHECK(range); +#else + (void)range; +#endif /** We now have the recomputed R point in pr, and its claimed x coordinate (modulo n) * in xr. Naively, we would extract the x coordinate from pr (requiring a inversion modulo p),