fix: check overflow for Pedersen grumpkin scalars

noir_stdlib/src/field/bn254.nr

@@ -2,8 +2,8 @@ use crate::field::field_less_than;
 use crate::runtime::is_unconstrained;
 
 // The low and high decomposition of the field modulus
-global PLO: Field = 53438638232309528389504892708671455233;
-global PHI: Field = 64323764613183177041862057485226039389;
+pub(crate) global PLO: Field = 53438638232309528389504892708671455233;
+pub(crate) global PHI: Field = 64323764613183177041862057485226039389;
 
 pub(crate) global TWO_POW_128: Field = 0x100000000000000000000000000000000;
 

noir_stdlib/src/hash/mod.nr

@@ -114,14 +114,23 @@ fn __derive_generators<let N: u32, let M: u32>(
 ) -> [EmbeddedCurvePoint; N] {}
 
 #[field(bn254)]
-// Same as from_field but:
-// does not assert the limbs are 128 bits
-// does not assert the decomposition does not overflow the EmbeddedCurveScalar
+// Decompose the input 'bn254 scalar' into two 128 bits limbs.
+// It is called 'unsafe' because it does not assert the limbs are 128 bits
+// Assuming the limbs are 128 bits:
+// Assert the decomposition does not overflow the field size.
 fn from_field_unsafe(scalar: Field) -> EmbeddedCurveScalar {
     // Safety: xlo and xhi decomposition is checked below
     let (xlo, xhi) = unsafe { crate::field::bn254::decompose_hint(scalar) };
     // Check that the decomposition is correct
     assert_eq(scalar, xlo + crate::field::bn254::TWO_POW_128 * xhi);
+    // Check that the decomposition does not overflow the field size
+    let (a, b) = if xhi == crate::field::bn254::PHI {
+        (xlo, crate::field::bn254::PLO)
+    } else {
+        (xhi, crate::field::bn254::PHI)
+    };
+    crate::field::bn254::assert_lt(a, b);
+
     EmbeddedCurveScalar { lo: xlo, hi: xhi }
 }