Merge pull request #3686 from matrix/fix_bof_26600

Fixed buffer overflow on module_26600.c / module_hash_encode()

docs/changes.txt

@@ -59,6 +59,7 @@
 - Fixed incompatible pointer types (salt1 and salt2 buf) in 31700 a3 kernel
 - Fixed incompatible pointer types (salt1 and salt2 buf) in 3730 a3 kernel
 - Handle signed/unsigned PDF permission P value for all PDF hash-modes
+- Fixed buffer overflow on module_26600.c / module_hash_encode()
 
 ##
 ## Technical

src/modules/module_26600.c

@@ -291,7 +291,7 @@ int module_hash_encode (MAYBE_UNUSED const hashconfig_t *hashconfig, MAYBE_UNUSE
 
   if ((ct_len % 4) > 0) j++;
 
-  u32 tmp_buf[784] = { 0 };
+  u32 tmp_buf[788] = { 0 };
 
   for (u32 i = 0; i < j; i++) tmp_buf[i] = byte_swap_32 (metamask->ct_buf[i]);