wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a possible crash in BN_from_montgomery_word

Browse source 
Thanks to Darovskikh Andrei for for reporting this issue.

Fixes: #5785

Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5793)
This commit is contained in:
Bernd Edlinger 2018-03-29 11:27:29 +02:00
parent 803cc8c7d4
commit f91e026e38
2 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
crypto/bn/bn_mont.c
View file

@ -95,6 +95,8 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont)
/* clear the top words of T */
i = max - r->top;
if (i < 0)
return 0;
if (i)
memset(&rp[r->top], 0, sizeof(*rp) * i);

18
test/bntest.c
View file

@ -408,9 +408,21 @@ static int test_modexp_mont5(void)
BN_free(b);
b = BN_dup(a);
BN_MONT_CTX_set(mont, n, ctx);
BN_mod_mul_montgomery(c, a, a, mont, ctx);
BN_mod_mul_montgomery(d, a, b, mont, ctx);
if (!TEST_BN_eq(c, d))
if (!TEST_true(BN_mod_mul_montgomery(c, a, a, mont, ctx))
|| !TEST_true(BN_mod_mul_montgomery(d, a, b, mont, ctx))
|| !TEST_BN_eq(c, d))
goto err;
/* Regression test for bug in BN_from_montgomery_word */
BN_hex2bn(&a,
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF");
BN_hex2bn(&n,
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF");
BN_MONT_CTX_set(mont, n, ctx);
if (!TEST_false(BN_mod_mul_montgomery(d, a, a, mont, ctx)))
goto err;
/* Regression test for bug in rsaz_1024_mul_avx2 */