Test for invalid encodings of BLS12381.

Author: armfazh

ecc/bls12381/g1.go

@@ -44,7 +44,7 @@ func (g *G1) SetBytes(b []byte) error {
 			l = G1SizeCompressed
 		}
 		zeros := make([]byte, l-1)
-		if (b[0]&0x1F) != 0 || subtle.ConstantTimeCompare(b[1:], zeros) != 1 {
+		if (b[0]&0x1F) != 0 || subtle.ConstantTimeCompare(b[1:l], zeros) != 1 {
 			return errEncoding
 		}
 		g.SetIdentity()

ecc/bls12381/g1_test.go

@@ -143,6 +143,13 @@ func TestG1Serial(t *testing.T) {
 			want = *randomG1(t)
 		}
 	})
+	t.Run("badPrefix", func(t *testing.T) {
+		q := new(G1)
+		b := make([]byte, G1Size)
+		for _, b[0] = range []byte{0x20, 0x60, 0xE0} {
+			test.CheckIsErr(t, q.SetBytes(b), mustErr)
+		}
+	})
 	t.Run("badLength", func(t *testing.T) {
 		q := new(G1)
 		p := randomG1(t)

ecc/bls12381/g2.go

@@ -42,7 +42,7 @@ func (g *G2) SetBytes(b []byte) error {
 			l = G2SizeCompressed
 		}
 		zeros := make([]byte, l-1)
-		if (b[0]&0x1F) != 0 || subtle.ConstantTimeCompare(b[1:], zeros) != 1 {
+		if (b[0]&0x1F) != 0 || subtle.ConstantTimeCompare(b[1:l], zeros) != 1 {
 			return errEncoding
 		}
 		g.SetIdentity()

ecc/bls12381/g2_test.go

@@ -102,6 +102,13 @@ func TestG2Serial(t *testing.T) {
 			want = *randomG2(t)
 		}
 	})
+	t.Run("badPrefix", func(t *testing.T) {
+		q := new(G2)
+		b := make([]byte, G2Size)
+		for _, b[0] = range []byte{0x20, 0x60, 0xE0} {
+			test.CheckIsErr(t, q.SetBytes(b), mustErr)
+		}
+	})
 	t.Run("badLength", func(t *testing.T) {
 		q := new(G2)
 		p := randomG2(t)