aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorXin LI <delphij@FreeBSD.org>2013-01-02 20:56:53 +0000
committerXin LI <delphij@FreeBSD.org>2013-01-02 20:56:53 +0000
commit451758c6115bda75e299808f60c4403de86398a8 (patch)
treec1f23b0a4b978801cc507218f72456c626277b20
parent0758ab5ea778e4ba36d2150af1bba602a48d6467 (diff)
downloadsrc-451758c6115bda75e299808f60c4403de86398a8.tar.gz
src-451758c6115bda75e299808f60c4403de86398a8.zip
Integrate OpenSSL changeset 22950 (appro):
bn_word.c: fix overflow bug in BN_add_word.
Notes
Notes: svn path=/vendor-crypto/openssl/dist/; revision=244973
-rw-r--r--crypto/bn/bn_word.c25
1 files changed, 8 insertions, 17 deletions
diff --git a/crypto/bn/bn_word.c b/crypto/bn/bn_word.c
index ee7b87c45ccd..de83a15b99c5 100644
--- a/crypto/bn/bn_word.c
+++ b/crypto/bn/bn_word.c
@@ -144,26 +144,17 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
a->neg=!(a->neg);
return(i);
}
- /* Only expand (and risk failing) if it's possibly necessary */
- if (((BN_ULONG)(a->d[a->top - 1] + 1) == 0) &&
- (bn_wexpand(a,a->top+1) == NULL))
- return(0);
- i=0;
- for (;;)
+ for (i=0;w!=0 && i<a->top;i++)
{
- if (i >= a->top)
- l=w;
- else
- l=(a->d[i]+w)&BN_MASK2;
- a->d[i]=l;
- if (w > l)
- w=1;
- else
- break;
- i++;
+ a->d[i] = l = (a->d[i]+w)&BN_MASK2;
+ w = (w>l)?1:0;
}
- if (i >= a->top)
+ if (w && i==a->top)
+ {
+ if (bn_wexpand(a,a->top+1) == NULL) return 0;
a->top++;
+ a->d[i]=w;
+ }
bn_check_top(a);
return(1);
}