BN_bin2bn did *not* contain an off-by-one error;

I'm still investigating what caused the segementation fault
(maybe "make clean; make" will cure it ...).
But BN_bin2bn should always reset ret->neg.

diff --git a/CHANGES b/CHANGES
index 370ec0f9b7b2025f58fec4f1831262eab8156ed8..a469186a2703c6f6f33e535bfc7e0e13eda2e080 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -3,9 +3,6 @@
 
  Changes between 0.9.6 and 0.9.7  [xx XXX 2000]
 
-  *) BN_bin2bn bugfix (off-by-one error).
-     [Bodo Moeller]
-
   *) Make BN_mod_inverse faster by explicitly handling small quotients
      in the Euclid loop. (Speed gain about 20% for small moduli [256 or
      512 bits], about 30% for larger ones [1024 or 2048 bits].)

diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c
index f0dc7d52dc257ef84abebb5619402a76d9bd7adf..d7a54d5fb580e615a4eacc6c461be3232143f55b 100644 (file)
--- a/crypto/bn/bn_lib.c
+++ b/crypto/bn/bn_lib.c
@@ -585,7 +585,6 @@ int BN_set_word(BIGNUM *a, BN_ULONG w)
        return(1);
        }
 
-/* ignore negative */
 BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
        {
        unsigned int i,m;
@@ -605,7 +604,8 @@ BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
                return(NULL);
        i=((n-1)/BN_BYTES)+1;
        m=((n-1)%(BN_BYTES));
-       ret->top=i-1;
+       ret->top=i;
+       ret->neg=0;
        while (n-- > 0)
                {
                l=(l<<8L)| *(s++);
@@ -776,4 +776,3 @@ int bn_cmp_words(const BN_ULONG *a, const BN_ULONG *b, int n)
                }
        return(0);
        }
-