From 2392eb77d237684a32b1290fc9e3d0e2f3b08554 Mon Sep 17 00:00:00 2001 From: Bernd Edlinger Date: Thu, 29 Mar 2018 11:27:29 +0200 Subject: [PATCH] Fix a possible crash in BN_from_montgomery_word Thanks to Darovskikh Andrei for for reporting this issue. Fixes: #5785 Fixes: #6302 Cherry-picked from f91e026e3832 (without test/bntest.c) Reviewed-by: Rich Salz Reviewed-by: Matthias St. Pierre (Merged from https://github.com/openssl/openssl/pull/6310) --- crypto/bn/bn_mont.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c index c0c174650c..dad3d07b3d 100644 --- a/crypto/bn/bn_mont.c +++ b/crypto/bn/bn_mont.c @@ -95,6 +95,8 @@ static int BN_from_montgomery_word(BIGNUM *ret, BIGNUM *r, BN_MONT_CTX *mont) /* clear the top words of T */ i = max - r->top; + if (i < 0) + return 0; if (i) memset(&rp[r->top], 0, sizeof(*rp) * i); -- 2.25.1