golang/go · error

overflowing coordinate

Error message

overflowing coordinate

What it means

Thrown by pointFromAffine (ecdsa.go:628) when a public key coordinate's bit-length exceeds the curve's BitSize. This guards the fixed-width FillBytes encoding: a coordinate larger than the field would silently overflow the buffer. It indicates a wrong curve assignment or a coordinate that was never reduced modulo the field prime.

Source

Thrown at src/crypto/ecdsa/ecdsa.go:628

	D := priv.D.FillBytes(make([]byte, size, maxScalarSize))

	return privateKeyCache.Get(priv, func() (*ecdsa.PrivateKey, error) {
		return ecdsa.NewPrivateKey(c, D, Q)
	}, func(k *ecdsa.PrivateKey) bool {
		return subtle.ConstantTimeCompare(k.PublicKey().Bytes(), Q) == 1 &&
			subtle.ConstantTimeCompare(k.Bytes(), D) == 1
	})
}

// pointFromAffine is used to convert the PublicKey to a nistec SetBytes input.
func pointFromAffine(curve elliptic.Curve, x, y *big.Int) ([]byte, error) {
	bitSize := curve.Params().BitSize
	// Reject values that would not get correctly encoded.
	if x.Sign() < 0 || y.Sign() < 0 {
		return nil, errors.New("negative coordinate")
	}
	if x.BitLen() > bitSize || y.BitLen() > bitSize {
		return nil, errors.New("overflowing coordinate")
	}
	// Encode the coordinates and let [ecdsa.NewPublicKey] reject invalid points.
	byteLen := (bitSize + 7) / 8
	buf := make([]byte, 1+2*byteLen)
	buf[0] = 4 // uncompressed point
	x.FillBytes(buf[1 : 1+byteLen])
	y.FillBytes(buf[1+byteLen : 1+2*byteLen])
	return buf, nil
}

// pointToAffine is used to convert a nistec Bytes encoding to a PublicKey.
func pointToAffine(curve elliptic.Curve, p []byte) (x, y *big.Int, err error) {
	if len(p) == 1 && p[0] == 0 {
		// This is the encoding of the point at infinity.
		return nil, nil, errors.New("ecdsa: public key point is the infinity")
	}
	byteLen := (curve.Params().BitSize + 7) / 8
	x = new(big.Int).SetBytes(p[1 : 1+byteLen])

View on GitHub (pinned to b6b368adc5)

Solutions

1. Ensure PublicKey.Curve matches the curve the key was generated on; load via standard parsing which sets Curve correctly.
2. Reduce coordinates modulo the field prime and confirm x.BitLen() <= curve.Params().BitSize before use.
3. Re-derive or re-parse the key from its canonical encoding (SEC1 uncompressed point).

Example fix

// before
pub := ecdsa.PublicKey{Curve: elliptic.P256(), X: p384X, Y: p384Y} // wrong curve
// -> error 242: overflowing coordinate

// after
pub := ecdsa.PublicKey{Curve: elliptic.P384(), X: p384X, Y: p384Y}

bs := pub.Curve.Params().BitSize
if pub.X.BitLen() > bs || pub.Y.BitLen() > bs {
    return fmt.Errorf("coordinate overflows %d-bit curve", bs)
}

func coordsFitCurve(pub *ecdsa.PublicKey) bool {
    bs := pub.Curve.Params().BitSize
    return pub.X.BitLen() <= bs && pub.Y.BitLen() <= bs
}

When it happens

Trigger: Same Sign/Verify conversion paths as 241. Triggered when x.BitLen() > curve.Params().BitSize || y.BitLen() > curve.Params().BitSize — e.g. assigning a P-384 point to a P-256 curve, or coordinates built from a hash without masking/reduction.

Common situations: Curve mismatch (key generated on P-384 but PublicKey.Curve set to P-256), importing a point from a system using a different field, or coordinates derived from raw hash output that exceed the field.

Related errors

• ecdsa: private key scalar is zero or negative
• negative coordinate
• ecdsa: public key point is the infinity
• crypto/ecdsa: use of custom curves is not allowed in FIPS 14
• zero parameter

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/6ecd262951ed14fd. Report an issue: GitHub.