From 1e1787326b392ccf72a31120e79e6511617058d2 Mon Sep 17 00:00:00 2001
From: modelsbridgeaicom-ship-it
 <modelsbridgeaicom-ship-it@users.noreply.github.com>
Date: Mon, 8 Jun 2026 04:05:59 +0800
Subject: [PATCH] Validate Shamir split thresholds

---
 src/functions/shamir_secret_sharing.js |  7 ++++++-
 test/jsbgl.test.js                     | 19 +++++++++++++++++--
 2 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/src/functions/shamir_secret_sharing.js b/src/functions/shamir_secret_sharing.js
index def4f16..a81cef4 100644
--- a/src/functions/shamir_secret_sharing.js
+++ b/src/functions/shamir_secret_sharing.js
@@ -86,6 +86,11 @@ module.exports = function (S) {
 
 
     S.__split_secret = (threshold, total,  secret, indexBits=8) => {
+        if ((typeof threshold !== "number") || (threshold % 1 !== 0) ||
+            (typeof total !== "number") || (total % 1 !== 0))
+            throw new TypeError("threshold and total should be integers");
+        if (threshold < 2) throw new Error("threshold must be at least 2");
+        if (total < 2) throw new Error("total must be at least 2");
         if (threshold > 255) throw new Error("threshold limit 255");
         if (total > 255) throw new Error("total limit 255");
         let index_mask = 2**indexBits - 1;
@@ -167,4 +172,4 @@ module.exports = function (S) {
     };
 
     S.__precompute_GF256_expLog(S);
-};
\ No newline at end of file
+};
diff --git a/test/jsbgl.test.js b/test/jsbgl.test.js
index 30834cc..da0ffba 100644
--- a/test/jsbgl.test.js
+++ b/test/jsbgl.test.js
@@ -275,8 +275,8 @@ describe(`${(browser) ? 'Browser' : 'Node'} test jsbgl library`, function () {
             s = splitMnemonic(2, 255, m, {embeddedIndex: true});
             equal(m, combineMnemonic(s));
 
-            s = splitMnemonic(1, 255, m, {embeddedIndex: true});
-            equal(m, combineMnemonic(s));
+            assert.throws(() => splitMnemonic(1, 255, m, {embeddedIndex: true}),
+                /threshold must be at least 2/);
 
             m = "stage amused wasp estate tomorrow outer satoshi version verb pudding ghost slender";
             s = splitMnemonic(3, 8, m, {embeddedIndex: true});
@@ -589,6 +589,21 @@ describe(`${(browser) ? 'Browser' : 'Node'} test jsbgl library`, function () {
 
             }
         }).timeout(14000);
+
+        it('Reject invalid secret split parameters', () => {
+            let secret = Buffer.from("secret", 'utf8');
+
+            assert.throws(() => __split_secret(1, 2, secret),
+                /threshold must be at least 2/);
+            assert.throws(() => __split_secret(0, 2, secret),
+                /threshold must be at least 2/);
+            assert.throws(() => __split_secret(2, 1, secret),
+                /total must be at least 2/);
+            assert.throws(() => __split_secret(2.5, 3, secret),
+                /threshold and total should be integers/);
+            assert.throws(() => __split_secret(2, 3.5, secret),
+                /threshold and total should be integers/);
+        });
     });
 
     describe("Private/Public key functions:", function () {