Commit 099e2968 authored by Kazuki Yamaguchi's avatar Kazuki Yamaguchi Committed by Matt Caswell
Browse files

Fix overflow check in BN_bn2dec() 



Fix an off by one error in the overflow check added by 07bed46f
("Check for errors in BN_bn2dec()").

Reviewed-by: default avatarStephen Henson <steve@openssl.org>
Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
parent 1c288878

crypto/bn/bn_print.c

+2 −3
Original line number Diff line number Diff line
@@ -92,14 +92,13 @@ char *BN_bn2dec(const BIGNUM *a) 
        if (BN_is_negative(t))

            *p++ = '-';



        i = 0;

        while (!BN_is_zero(t)) {

            if (lp - bn_data >= bn_data_num)

                goto err;

            *lp = BN_div_word(t, BN_DEC_CONV);

            if (*lp == (BN_ULONG)-1)

                goto err;

            lp++;

            if (lp - bn_data >= bn_data_num)

                goto err;

        }

        lp--;

        /*