The low-level Dilithium code as used by Libgcrypt uses a static array PRE but fills it from the CTX arg w/o a check. This bug needs to be fixed but real-world severity is low because the context is a protocol or implementation defined constant and thus not derived from attacker controlled data..
Reported-by: Calif.io in collaboration with Claude and Anthropic Research.
The minimum fix avoids changes needed, thus, a bit confusing as a whole.
Here are better changes:
FWIW: There is actually a problem in the reference code: Having a
fixed size buffer inside a function and allowing the caller to provide
content at arbitrary length is bad coding style because the caller
needs to know internals of the called function (in a different source
file).
This should be reported to the reference code maintainers.