ringct: prevent a potential very large allocation

Reported by QuarksLab.
6 years ago · 61632dc166
parent a4317e61b5
commit 61632dc166
1 changed files with 2 additions and 2 deletions
--- a/src/ringct/rctTypes.h
+++ b/src/ringct/rctTypes.h
@ -317,9 +317,9 @@ namespace rct {
            ar.begin_array();
            uint32_t nbp = bulletproofs.size();
            FIELD(nbp)
-            PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs);
-            if (bulletproofs.size() > outputs)
+            if (nbp > outputs)
              return false;
+            PREPARE_CUSTOM_VECTOR_SERIALIZATION(nbp, bulletproofs);
            for (size_t i = 0; i < nbp; ++i)
            {
              FIELDS(bulletproofs[i])