Darrel Hankerson <dhankers@cacr.math.uwaterloo.ca> correctly discovered

that of the result pointer to bn_mul was the same as one of the two arguments,
That argument might have it's sign destroyed.  He provided this fix.