Use of Uninitialized Resource

Summary

Versions of the package fastecdsa prior to 2.3.2 are vulnerable to the Use of Uninitialized Variables on the stack, via the "curvemath_mul" function in "src/curveMath.c", due to being used and interpreted as user-defined type. Depending on the variable's actual value it could be arbitrary "free()", "arbitrary realloc()", Null Pointer Dereference, and others. Since the stack can be controlled by the attacker, the vulnerability could be used to corrupt allocator structure, leading to possible heap exploitation. The attacker could cause Denial of Service (DoS) by exploiting this vulnerability.