From: Geoff Thorpe <geoff@openssl.org>
Date: Fri, 6 Jun 2003 17:53:24 +0000 (+0000)
Subject: This memset() in the ubsec ENGINE is a bug. Zeroing out the result array
X-Git-Tag: OpenSSL_0_9_7c~87
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=bc63a2ee0e129b0e2fec38771c1c5c87217b9a1d;p=oweals%2Fopenssl.git

This memset() in the ubsec ENGINE is a bug. Zeroing out the result array
should not be necessary in any case, but more importantly the result and
input BIGNUMs could be the same, in which case this is clearly a problem.

Submitted by: Jonathan Hersch
Reviewed by: Joe Orton
Approved by: Geoff Thorpe
---

diff --git a/crypto/engine/hw_ubsec.c b/crypto/engine/hw_ubsec.c
index 6286dd851c..5234a08a07 100644
--- a/crypto/engine/hw_ubsec.c
+++ b/crypto/engine/hw_ubsec.c
@@ -561,7 +561,6 @@ static int ubsec_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 		UBSECerr(UBSEC_F_UBSEC_MOD_EXP, UBSEC_R_BN_EXPAND_FAIL);
 		return 0;
 	}
-	memset(r->d, 0, BN_num_bytes(m));
 
 	if ((fd = p_UBSEC_ubsec_open(UBSEC_KEY_DEVICE_NAME)) <= 0) {
 		fd = 0;