When BN_add_word() reaches top, it shouldn't try to add the the corresponding

word, since that word may not be zero.

diff --git a/crypto/bn/bn_word.c b/crypto/bn/bn_word.c
index cd59baa2c4902910f34a0268627512a24e839f0e..988e0ca7b37fb30fac9fa1646e084acf5bb3dec0 100644 (file)
--- a/crypto/bn/bn_word.c
+++ b/crypto/bn/bn_word.c
@@ -123,7 +123,10 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
        i=0;
        for (;;)
                {
-               l=(a->d[i]+(BN_ULONG)w)&BN_MASK2;
+               if (i >= a->top)
+                       l=w;
+               else
+                       l=(a->d[i]+(BN_ULONG)w)&BN_MASK2;
                a->d[i]=l;
                if (w > l)
                        w=1;