Wrong exception thrown in removed Java bindings #948

1. 
   darkverbito commented at 4:45 pm on June 4, 2021: none

   I think there’s a null pointer dereference issue here:

   https://github.com/bitcoin-core/secp256k1/blob/d644dda5c9dbdecee52d1aa259235510fdc2d4ee/src/java/org/bitcoin/NativeSecp256k1.java#L401

2. 
   real-or-random commented at 5:07 pm on June 4, 2021: contributor

   Yes, the order of the checks should be reversed.

   But:

   1. I don’t see how this is a security vulnerability. It will throw a NullPointerException instead of an AssertFailException but that’s per se not a security issue.

   2. This code is not in our repo. The Java bindings haven been removed more than a year ago, see #682. Maybe you want to report this at the repo mentioned there but please don’t call it a vulnerability and create unnecessary attention.

   edit: Let me add that we prefer that (potential) vulnerabilities are disclosed privately. We have contact information here: https://github.com/bitcoin-core/secp256k1/blob/master/SECURITY.md

3. real-or-random closed this on Jun 4, 2021

   ---

4. real-or-random renamed this:
   Security Vulnerability - null pointer dereference
   Wrong exception thrown in removed Java bindings
   on Jun 4, 2021
5. 
   darkverbito commented at 5:12 pm on June 4, 2021: none

   Thanks for the update!

Contributors
darkverbito real-or-random