Commit 3cc546a3 authored by Geoff Thorpe's avatar Geoff Thorpe
Browse files

bignum: fix boundary condition in montgomery logic 



It's not clear whether this inconsistency could lead to an actual
computation error, but it involved a BIGNUM being passed around the
montgomery logic in an inconsistent state. This was found using flags
-DBN_DEBUG -DBN_DEBUG_RAND, and working backwards from this assertion
in 'ectest';

ectest: bn_mul.c:960: BN_mul: Assertion `(_bnum2->top == 0) ||
(_bnum2->d[_bnum2->top - 1] != 0)' failed

Signed-off-by: default avatarGeoff Thorpe <geoff@openssl.org>
(cherry picked from commit a5292618)
parent c434f7f8

crypto/bn/bn_exp.c

+3 −0
Original line number Diff line number Diff line
@@ -493,6 +493,9 @@ int BN_mod_exp_mont(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p, 
		r->d[0] = (0-m->d[0])&BN_MASK2;

		for(i=1;i<j;i++) r->d[i] = (~m->d[i])&BN_MASK2;

		r->top = j;

		/* Upper words will be zero if the corresponding words of 'm'

		 * were 0xfff[...], so decrement r->top accordingly. */

		bn_correct_top(r);

		}

	else

#endif