Skip to content

frodo-kem: return error instead of panicking on empty serde input#259

Merged
tarcieri merged 1 commit intoRustCrypto:masterfrom
rot256:fix/frodo-kem-serde-empty-panic
Feb 11, 2026
Merged

frodo-kem: return error instead of panicking on empty serde input#259
tarcieri merged 1 commit intoRustCrypto:masterfrom
rot256:fix/frodo-kem-serde-empty-panic

Conversation

@rot256
Copy link
Copy Markdown
Contributor

@rot256 rot256 commented Feb 11, 2026

Don't panic when attempting to de-serialize empty byte slices.

Indexing v[0] on empty input panics with index out of bounds.
Use split_first() to return a deserialization error instead.
@tarcieri tarcieri merged commit 2ea7024 into RustCrypto:master Feb 11, 2026
9 checks passed
@tarcieri tarcieri mentioned this pull request Apr 28, 2026
tarcieri added a commit that referenced this pull request Apr 28, 2026
## Added
- Preliminary `no_std` support (#238)

## Changed
- Edition changed to 2024 and MSRV bumped to 1.85 (#118)
- Relax MSRV policy and allow MSRV bumps in patch releases
- Bump `hybrid-array` dependency to v0.4 (#129)
- Bump `serdect` dependency to v0.4 (#130)
- Bump `getrandom` dependency to v0.4 (#245)
- Bump `rand_core` dependency to v0.10 (#245)
- Bump `sha3` dependency to v0.11 (#282)
- Bump `aes` to v0.9 (#294)
- Bump `getrandom` to v0.4 (#294)
- Bump `chacha20` to v0.10 (#294)
- Bump `toml` to v1 (#294)
  
## Removed
- `safe-oqs` equivalence tests (#166)

## Fixed
- Return error instead of panicking on empty `serde` input (#259)
- OpenSSL EVP contexts memory leak (#260)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants