fix bn_expand2

diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c
index 77a9e3225454c2428fee73fdcc6a85fa310a3732..60e3c680bc1813353614696b51cea4434c4dd56f 100644 (file)
--- a/crypto/bn/bn_lib.c
+++ b/crypto/bn/bn_lib.c
@@ -425,7 +425,7 @@ BIGNUM *bn_dup_expand(const BIGNUM *b, int words)
 
 /* This is an internal function that should not be used in applications.
  * It ensures that 'b' has enough room for a 'words' word number
- * and initialises the unused part of b->d with leading zeros.
+ * and initialises any unused part of b->d with leading zeros.
  * It is mostly used by the various BIGNUM routines. If there is an error,
  * NULL is returned. If not, 'b' is returned. */
 
@@ -450,15 +450,18 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)
                }
        
        /* NB: bn_wexpand() calls this only if the BIGNUM really has to grow */
-       A = &(b->d[b->top]);
-       for (i=(words - b->top)>>3; i>0; i--,A+=8)
+       if ((b != NULL) && (b->top < b->dmax))
                {
-               A[0]=0; A[1]=0; A[2]=0; A[3]=0;
-               A[4]=0; A[5]=0; A[6]=0; A[7]=0;
+               A = &(b->d[b->top]);
+               for (i=(words - b->top)>>3; i>0; i--,A+=8)
+                       {
+                       A[0]=0; A[1]=0; A[2]=0; A[3]=0;
+                       A[4]=0; A[5]=0; A[6]=0; A[7]=0;
+                       }
+               for (i=(words - b->top)&7; i>0; i--,A++)
+                       A[0]=0;
                }
-       for (i=(words - b->top)&7; i>0; i--,A++)
-               A[0]=0;
-       
+               
        return b;
        }