Fix overflow check in BN_bn2dec()

Fix an off by one error in the overflow check added by 07bed46f33
("Check for errors in BN_bn2dec()").

Reviewed-by: Stephen Henson <steve@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(cherry picked from commit 099e2968ed)
This commit is contained in:
Kazuki Yamaguchi 2016-08-22 02:36:36 +09:00 committed by Matt Caswell
parent cfd40fd39e
commit 3612ff6fce

View file

@ -141,14 +141,13 @@ char *BN_bn2dec(const BIGNUM *a)
if (BN_is_negative(t))
*p++ = '-';
i = 0;
while (!BN_is_zero(t)) {
if (lp - bn_data >= bn_data_num)
goto err;
*lp = BN_div_word(t, BN_DEC_CONV);
if (*lp == (BN_ULONG)-1)
goto err;
lp++;
if (lp - bn_data >= bn_data_num)
goto err;
}
lp--;
/*