fix(webauthn): Fix buffer out of bounds

include/TrustWalletCore/TWWebAuthn.h

@@ -24,7 +24,7 @@ struct TWPublicKey *_Nullable TWWebAuthnGetPublicKey(TWData *_Nonnull attestatio
 /// \param signature ASN encoded webauthn signature: https://www.w3.org/TR/webauthn-2/#sctn-signature-attestation-types
 /// \return Concatenated r and s values.
 TW_EXPORT_STATIC_METHOD
-TWData *_Nonnull TWWebAuthnGetRSValues(TWData *_Nonnull signature);
+TWData *_Nullable TWWebAuthnGetRSValues(TWData *_Nonnull signature);
 
 /// Reconstructs the original message that was signed via P256 curve. Can be used for signature validation.
 ///

src/Aeternity/Signer.cpp

@@ -15,7 +15,7 @@ using namespace TW;
 namespace TW::Aeternity {
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto privateKey = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+    auto privateKey = PrivateKey(input.private_key(), TWCurveED25519);
     std::string sender_id = input.from_address();
     std::string recipient_id = input.to_address();
     std::string payload = input.payload();

src/Aion/Signer.cpp

@@ -9,7 +9,7 @@ using namespace TW;
 namespace TW::Aion {
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+    auto key = PrivateKey(input.private_key(), TWCurveED25519);
     auto transaction = Signer::buildTransaction(input);
     Signer::sign(key, transaction);
 

src/Algorand/Signer.cpp

@@ -18,7 +18,7 @@ const std::string ASSET_TRANSACTION = "axfer";
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
     auto protoOutput = Proto::SigningOutput();
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+    auto key = PrivateKey(input.private_key(), TWCurveED25519);
     auto pubkey = key.getPublicKey(TWPublicKeyTypeED25519);
 
     auto preImageData = Signer::preImage(pubkey, input);

src/Cbor.cpp

@@ -246,6 +246,11 @@ uint32_t Decode::getTotalLen() const {
     }
 }
 
+Decode::MajorType Decode::getMajorType() const {
+    TypeDesc typeDesc = getTypeDesc();
+    return typeDesc.majorType;
+}
+
 uint64_t Decode::getValue() const {
     TypeDesc typeDesc = getTypeDesc();
     if (typeDesc.majorType != MT_uint && typeDesc.majorType != MT_negint) {
@@ -328,9 +333,9 @@ vector<Decode> Decode::getCompoundElements(uint32_t countMultiplier, TW::byte ex
     return elems;
 }
 
-vector<pair<Decode, Decode>> Decode::getMapElements() const {
+Decode::MapElements Decode::getMapElements() const {
     auto elems = getCompoundElements(2, MT_map);
-    vector<pair<Decode, Decode>> map;
+    MapElements map;
     for (auto i = 0ul; i < elems.size(); i += 2) {
         map.emplace_back(make_pair(elems[i], elems[i + 1]));
     }

src/Cbor.h

@@ -85,9 +85,24 @@ class Decode {
     /// Constructor, create from CBOR byte stream
     Decode(const Data& input);
 
-public: // decoding
+public:
+    enum MajorType {
+        MT_uint = 0,
+        MT_negint = 1,
+        MT_bytes = 2,
+        MT_string = 3,
+        MT_array = 4,
+        MT_map = 5,
+        MT_tag = 6,
+        MT_special = 7,
+    };
+
+    using MapElements = std::vector<std::pair<Decode, Decode>>;
+
     /// Check if contains a valid CBOR byte stream.
     bool isValid() const;
+    // Get the major type
+    MajorType getMajorType() const;
     /// Get the value of a simple type
     uint64_t getValue() const;
     /// Get the value of a string/bytes as string
@@ -97,7 +112,7 @@ class Decode {
     /// Get all elements of array
     std::vector<Decode> getArrayElements() const { return getCompoundElements(1, MT_array); }
     /// Get all elements of map
-    std::vector<std::pair<Decode, Decode>> getMapElements() const;
+    MapElements getMapElements() const;
     /// Get the tag number
     uint64_t getTagValue() const;
     /// Get the tag element
@@ -107,17 +122,6 @@ class Decode {
     uint32_t length() const { return subLen; }
     /// Return encoded form (useful e.g for parsed out sub-parts)
     Data encoded() const;
-
-    enum MajorType {
-        MT_uint = 0,
-        MT_negint = 1,
-        MT_bytes = 2,
-        MT_string = 3,
-        MT_array = 4,
-        MT_map = 5,
-        MT_tag = 6,
-        MT_special = 7,
-    };
 
 private:
     /// Struct used to keep reference to original data

src/EOS/Signer.cpp

@@ -39,7 +39,7 @@ Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
         }
 
         // sign the transaction with a Signer
-        auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), curve);
+        auto key = PrivateKey(input.private_key(), curve);
         signer.sign(key, type, tx);
 
         // Pack the transaction and add the json encoding to Signing outputput

src/Filecoin/Signer.cpp

@@ -77,7 +77,7 @@ Proto::SigningOutput Signer::compile(const Data& signature, const PublicKey& pub
 
 Proto::SigningOutput Signer::signSecp256k1(const Proto::SigningInput& input) {
     // Load private key and transaction from Protobuf input.
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    auto key = PrivateKey(input.private_key(), TWCurveSECP256k1);
     auto pubkey = key.getPublicKey(TWPublicKeyTypeSECP256k1Extended);
 
     auto transaction = Signer::buildTx(pubkey, input);
@@ -123,7 +123,7 @@ Transaction Signer::buildTx(const PublicKey& publicKey, const Proto::SigningInpu
 /// https://github.com/filecoin-project/lotus/blob/ce17546a762eef311069e13410d15465d832a45e/chain/messagesigner/messagesigner.go#L197-L211
 Proto::SigningOutput Signer::signDelegated(const Proto::SigningInput& input) {
     // Load private key from Protobuf input.
-    auto privateKey = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    auto privateKey = PrivateKey(input.private_key(), TWCurveSECP256k1);
     auto pubkey = privateKey.getPublicKey(TWPublicKeyTypeSECP256k1Extended);
 
     // Load the transaction params.

src/Harmony/Signer.cpp

@@ -86,7 +86,7 @@ std::string Signer::signJSON(const std::string& json, const Data& key) {
 }
 
 Proto::SigningOutput Signer::signTransaction(const Proto::SigningInput& input) {
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    auto key = PrivateKey(input.private_key(), TWCurveSECP256k1);
 
     auto transaction = Signer::buildUnsignedTransaction(input);
 
@@ -131,7 +131,7 @@ uint8_t Signer::getEnum<CollectRewards>() noexcept {
 
 template <typename T>
 Proto::SigningOutput Signer::signStaking(const Proto::SigningInput &input, function<T(const Proto::SigningInput &input)> func) {
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    auto key = PrivateKey(input.private_key(), TWCurveSECP256k1);
     auto stakingTx = buildUnsignedStakingTransaction(input, func);
 
     auto signer = Signer(uint256_t(load(input.chain_id())));

src/Hedera/Signer.cpp

@@ -86,7 +86,7 @@ static inline Proto::SigningOutput sign(const proto::TransactionBody& body, cons
 namespace TW::Hedera {
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto privateKey = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+    auto privateKey = PrivateKey(input.private_key(), TWCurveED25519);
     auto body = internals::transactionBodyPrerequisites(input);
 
     switch (input.body().data_case()) {

src/NEO/Signer.cpp

@@ -264,7 +264,7 @@ Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
     auto output = Proto::SigningOutput();
     try {
         auto signer =
-            Signer(PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveNIST256p1));
+            Signer(PrivateKey(input.private_key(), TWCurveNIST256p1));
         Proto::TransactionPlan plan;
         if (input.has_plan()) {
             plan = input.plan();

src/Nebulas/Signer.cpp

@@ -15,7 +15,7 @@ Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
 
     auto tx = signer.buildTransaction(input);
 
-    auto privateKey = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    auto privateKey = PrivateKey(input.private_key(), TWCurveSECP256k1);
     signer.sign(privateKey, tx);
 
     auto output = Proto::SigningOutput();

src/Nimiq/Signer.cpp

@@ -10,7 +10,7 @@
 namespace TW::Nimiq {
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+    auto key = PrivateKey(input.private_key(), TWCurveED25519);
     auto pubkey = key.getPublicKey(TWPublicKeyTypeED25519);
     std::array<uint8_t, 32> pubkeyBytes;
     std::copy(pubkey.bytes.begin(), pubkey.bytes.end(), pubkeyBytes.data());

src/PrivateKey.cpp

@@ -114,12 +114,19 @@ TWPrivateKeyType PrivateKey::getType(TWCurve curve) noexcept {
     }
 }
 
- PrivateKey::PrivateKey(const Data& data) {
-     if (!isValid(data)) {
-         throw std::invalid_argument("Invalid private key data");
-     }
-     bytes = data;
- }
+PrivateKey::PrivateKey(const Data& data) {
+    if (!isValid(data)) {
+     throw std::invalid_argument("Invalid private key data");
+    }
+    bytes = data;
+}
+
+PrivateKey::PrivateKey(Data&& data) {
+    if (!isValid(data)) {
+        throw std::invalid_argument("Invalid private key data");
+    }
+    bytes = std::move(data);
+}
 
 PrivateKey::PrivateKey(const Data& data, TWCurve curve) {
     if (!isValid(data, curve)) {
@@ -129,6 +136,14 @@ PrivateKey::PrivateKey(const Data& data, TWCurve curve) {
     _curve = curve;
 }
 
+PrivateKey::PrivateKey(Data&& data, TWCurve curve) {
+    if (!isValid(data, curve)) {
+        throw std::invalid_argument("Invalid private key data");
+    }
+    bytes = std::move(data);
+    _curve = curve;
+}
+
 PrivateKey::PrivateKey(
     const Data& key1, const Data& extension1, const Data& chainCode1,
     const Data& key2, const Data& extension2, const Data& chainCode2) {

src/PrivateKey.h

@@ -47,11 +47,20 @@ class PrivateKey {
     /// @deprecated Use PrivateKey(const Data& data, TWCurve curve) instead
     explicit PrivateKey(const Data& data);
 
-    /// Initializes a private key with an array of bytes and a curve.  
+    /// Initializes a private key with an array of bytes.  Size must be exact (normally 32, or 192 for extended)
+    /// @deprecated Use PrivateKey(const Data& data, TWCurve curve) instead
+    explicit PrivateKey(Data&& data);
+
+    /// Initializes a private key with an array of bytes and a curve.
     /// Size of the data must be exact (normally 32, or 192 for extended)
     /// Signing functions will throw an exception if the provided curve is different from the one specified.
     explicit PrivateKey(const Data& data, TWCurve curve);
 
+    /// Initializes a private key with an array of bytes and a curve.
+    /// Size of the data must be exact (normally 32, or 192 for extended)
+    /// Signing functions will throw an exception if the provided curve is different from the one specified.
+    explicit PrivateKey(Data&& data, TWCurve curve);
+
     /// Initializes a private key from a string of bytes.
     /// @deprecated Use PrivateKey(const std::string& data, TWCurve curve) instead
     explicit PrivateKey(const std::string& data) : PrivateKey(TW::data(data)) {}

src/Stellar/Signer.cpp

@@ -23,7 +23,7 @@ Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
 
 std::string Signer::sign() const noexcept {
 
-    auto key = PrivateKey(Data(_input.private_key().begin(), _input.private_key().end()), TWCurveED25519);
+    auto key = PrivateKey(_input.private_key(), TWCurveED25519);
     auto account = Address(_input.account());
     auto encoded = encode(_input);
 

src/Tezos/Signer.cpp

@@ -17,7 +17,7 @@ namespace TW::Tezos {
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
     auto signer = Signer();
-    PrivateKey key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveED25519);
+    PrivateKey key = PrivateKey(input.private_key(), TWCurveED25519);
     Data encoded;
     if (input.encoded_operations().empty()) {
         auto operationList = Tezos::OperationList(input.operation_list().branch());

src/Theta/Signer.cpp

@@ -12,7 +12,7 @@ using RLP = TW::Ethereum::RLP;
 namespace TW::Theta {
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto pkFrom = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    auto pkFrom = PrivateKey(input.private_key(), TWCurveSECP256k1);
     auto from = Ethereum::Address(pkFrom.getPublicKey(TWPublicKeyTypeSECP256k1Extended));
 
     auto transaction = Transaction(

src/Tron/Signer.cpp

@@ -405,7 +405,7 @@ Data serialize(const protocol::Transaction& tx) noexcept {
 }
 
 Proto::SigningOutput signDirect(const Proto::SigningInput& input) {
-    const auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    const auto key = PrivateKey(input.private_key(), TWCurveSECP256k1);
     auto output = Proto::SigningOutput();
 
     Data hash;
@@ -464,7 +464,7 @@ Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
 
     const auto hash = Hash::sha256(serialize(tx));
 
-    const auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    const auto key = PrivateKey(input.private_key(), TWCurveSECP256k1);
     const auto signature = key.sign(hash);
 
     const auto json = transactionJSON(tx, hash, signature).dump();

src/VeChain/Signer.cpp

@@ -11,7 +11,7 @@ using namespace TW;
 namespace TW::VeChain {
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto key = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveSECP256k1);
+    auto key = PrivateKey(input.private_key(), TWCurveSECP256k1);
     auto transaction = Transaction();
     transaction.chainTag = static_cast<uint8_t>(input.chain_tag());
     transaction.blockRef = input.block_ref();

src/Waves/Signer.cpp

@@ -11,7 +11,7 @@ using namespace TW;
 namespace TW::Waves {
 
 Proto::SigningOutput Signer::sign(const Proto::SigningInput& input) noexcept {
-    auto privateKey = PrivateKey(Data(input.private_key().begin(), input.private_key().end()), TWCurveCurve25519);
+    auto privateKey = PrivateKey(input.private_key(), TWCurveCurve25519);
     auto publicKey = privateKey.getPublicKey(TWPublicKeyTypeCURVE25519);
     auto transaction = Transaction(input, publicKey.bytes);