Commit dcfb57c7 authored by Geoff Thorpe's avatar Geoff Thorpe
Browse files

This memset() in the ubsec ENGINE is a bug. Zeroing out the result array 

should not be necessary in any case, but more importantly the result and
input BIGNUMs could be the same, in which case this is clearly a problem.

Submitted by: Jonathan Hersch
Reviewed by: Joe Orton
Approved by: Geoff Thorpe
parent 2ee67f1d

engines/e_ubsec.c

+0 −1
Original line number Diff line number Diff line
@@ -566,7 +566,6 @@ static int ubsec_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, 
		UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_BN_EXPAND_FAIL);

		return 0;

	}

	memset(r->d, 0, BN_num_bytes(m));



	if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {

		fd = 0;