bug fix: bn_sqr_recursive output is twice its input size.

diff --git a/CHANGES b/CHANGES
index d7195d900713a220b65401d220a38028dd60870f..db742fcb50e0cce2bd2a91a446703e31938e3ff1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -12,6 +12,9 @@
          *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
          +) applies to 0.9.7 only
 
+  *) BN_sqr() bug fix.
+     [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>]
+
   *) Make it possible to unload ranges of ERR strings with a new
      "ERR_unload_strings" function.
      [Geoff Thorpe]

diff --git a/crypto/bn/bn_sqr.c b/crypto/bn/bn_sqr.c
index b75e6194d029566584aa03f121023f265727da24..c1d0cca438dc4358218386490a1e543bef2592c9 100644 (file)
--- a/crypto/bn/bn_sqr.c
+++ b/crypto/bn/bn_sqr.c
@@ -245,7 +245,7 @@ void bn_sqr_recursive(BN_ULONG *r, const BN_ULONG *a, int n2, BN_ULONG *t)
        if (!zero)
                bn_sqr_recursive(&(t[n2]),t,n,p);
        else
-               memset(&(t[n2]),0,n*sizeof(BN_ULONG));
+               memset(&(t[n2]),0,n2*sizeof(BN_ULONG));
        bn_sqr_recursive(r,a,n,p);
        bn_sqr_recursive(&(r[n2]),&(a[n]),n,p);