From 4ee1bafb7e5ca18fe5ea4626015678760f5ad0be Mon Sep 17 00:00:00 2001
From: mohammed arib <arib@bugqore.com>
Date: Tue, 13 Oct 2026 15:56:11 +0530
Subject: [PATCH] bindings/rust: guard scalars length check against overflow

---
 bindings/rust/src/pippenger-no_std.rs   |  2 +-
 bindings/rust/src/pippenger-test_mod.rs | 23 +++++++++++++++++++++++
 bindings/rust/src/pippenger.rs          |  2 +-
 3 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/bindings/rust/src/pippenger-no_std.rs b/bindings/rust/src/pippenger-no_std.rs
index 182737ac..7937738e 100644
--- a/bindings/rust/src/pippenger-no_std.rs
+++ b/bindings/rust/src/pippenger-no_std.rs
@@ -83,7 +83,7 @@ macro_rules! pippenger_mult_impl {
                 let npoints = self.len();
                 let nbytes = (nbits + 7) / 8;
 
-                if scalars.len() < nbytes * npoints {
+                if nbytes.checked_mul(npoints).map_or(true, |n| scalars.len() < n) {
                     panic!("scalars length mismatch");
                 }
 
diff --git a/bindings/rust/src/pippenger-test_mod.rs b/bindings/rust/src/pippenger-test_mod.rs
index a471185b..1ce96c82 100644
--- a/bindings/rust/src/pippenger-test_mod.rs
+++ b/bindings/rust/src/pippenger-test_mod.rs
@@ -80,6 +80,29 @@ macro_rules! pippenger_test_mod {
                 let points = $points::from(&points);
                 assert_eq!(naive, points.add());
             }
+
+            #[test]
+            #[should_panic(expected = "scalars length mismatch")]
+            fn test_mult_scalars_len_overflow() {
+                // |nbytes * npoints| is chosen to wrap usize back to zero
+                // (2^(W-4) * 16 == 2^W) so that an overflow-safe length check
+                // is the only thing standing between a bogus |nbits| and a
+                // wild out-of-bounds read inside blst.
+                let npoints: usize = 16;
+                let nbytes: usize = usize::MAX / 16 + 1;
+                let nbits: usize = nbytes * 8;
+
+                let mut points: Vec<$point> = Vec::with_capacity(npoints);
+                unsafe { points.set_len(points.capacity()) };
+                let one = [1u8];
+                for i in 0..npoints {
+                    unsafe { $mult(&mut points[i], $generator(), &one[0], 1) };
+                }
+                let points = $points::from(&points);
+
+                let scalars = [0u8; 32];
+                let _ = points.mult(&scalars, nbits);
+            }
         }
     };
 }
diff --git a/bindings/rust/src/pippenger.rs b/bindings/rust/src/pippenger.rs
index c2e98181..964c7238 100644
--- a/bindings/rust/src/pippenger.rs
+++ b/bindings/rust/src/pippenger.rs
@@ -138,7 +138,7 @@ macro_rules! pippenger_mult_impl {
                 let npoints = self.len();
                 let nbytes = (nbits + 7) / 8;
 
-                if scalars.len() < nbytes * npoints {
+                if nbytes.checked_mul(npoints).map_or(true, |n| scalars.len() < n) {
                     panic!("scalars length mismatch");
                 }