From 3bb1891beae488f9d7ed25281de11d348e702ba9 Mon Sep 17 00:00:00 2001
From: Chandan MK <chandan@labs.digiscrypt.com>
Date: Sat, 19 Sep 2026 12:04:08 +0530
Subject: [PATCH] LibCrypto: Reject wrongly sized inputs in Ed25519::verify

verify() copied two 32-byte halves out of the signature and read 32
bytes of the public key without looking at the size of either span, so
a shorter buffer was read past its end. SSHServer, LibTLS and LibWeb
all pass buffers whose size is chosen by the peer.
---
 Tests/LibCrypto/TestEd25519.cpp               | 28 +++++++++++++++++++
 .../Libraries/LibCrypto/Curves/Ed25519.cpp    |  3 ++
 2 files changed, 31 insertions(+)

diff --git a/Tests/LibCrypto/TestEd25519.cpp b/Tests/LibCrypto/TestEd25519.cpp
index bb801a20b2d..c5d80fdac5f 100644
--- a/Tests/LibCrypto/TestEd25519.cpp
+++ b/Tests/LibCrypto/TestEd25519.cpp
@@ -154,3 +154,31 @@ TEST_CASE(TEST_SHA_ABC)
 
     ed25519_test(public_key, private_key, message, expected_signature);
 }
+
+TEST_CASE(verify_rejects_inputs_of_the_wrong_size)
+{
+    // https://datatracker.ietf.org/doc/html/rfc8032#section-7.1
+    Array<u8, 32> public_key = {
+        0xd7, 0x5a, 0x98, 0x01, 0x82, 0xb1, 0x0a, 0xb7,
+        0xd5, 0x4b, 0xfe, 0xd3, 0xc9, 0x64, 0x07, 0x3a,
+        0x0e, 0xe1, 0x72, 0xf3, 0xda, 0xa6, 0x23, 0x25,
+        0xaf, 0x02, 0x1a, 0x68, 0xf7, 0x07, 0x51, 0x1a
+    };
+
+    Array<u8, 0> message = {};
+
+    Array<u8, 64> signature = {
+        0xe5, 0x56, 0x43, 0x00, 0xc3, 0x60, 0xac, 0x72,
+        0x90, 0x86, 0xe2, 0xcc, 0x80, 0x6e, 0x82, 0x8a,
+        0x84, 0x87, 0x7f, 0x1e, 0xb8, 0xe5, 0xd9, 0x74,
+        0xd8, 0x73, 0xe0, 0x65, 0x22, 0x49, 0x01, 0x55,
+        0x5f, 0xb8, 0x82, 0x15, 0x90, 0xa3, 0x3b, 0xac,
+        0xc6, 0x1e, 0x39, 0x70, 0x1c, 0xf9, 0xb4, 0x6b,
+        0xd2, 0x5b, 0xf5, 0xf0, 0x59, 0x5b, 0xbe, 0x24,
+        0x65, 0x51, 0x41, 0x43, 0x8e, 0x7a, 0x10, 0x0b
+    };
+
+    EXPECT(Crypto::Curves::Ed25519::verify(public_key, signature, message));
+    EXPECT(!Crypto::Curves::Ed25519::verify(public_key, signature.span().trim(63), message));
+    EXPECT(!Crypto::Curves::Ed25519::verify(public_key.span().trim(31), signature, message));
+}
diff --git a/Userland/Libraries/LibCrypto/Curves/Ed25519.cpp b/Userland/Libraries/LibCrypto/Curves/Ed25519.cpp
index 0844902dde4..782775c75c1 100644
--- a/Userland/Libraries/LibCrypto/Curves/Ed25519.cpp
+++ b/Userland/Libraries/LibCrypto/Curves/Ed25519.cpp
@@ -427,6 +427,9 @@ bool Ed25519::verify(ReadonlyBytes public_key, ReadonlyBytes signature, Readonly
     // NOTE: We dont care about F, since we dont implement Ed25519ctx or Ed25519PH
     // NOTE: C is the internal state, so its not a parameter
 
+    if (public_key.size() != key_size() || signature.size() != signature_size())
+        return false;
+
     auto half_signature_size = signature_size() / 2;
 
     // Decode the first half as a point R