From f3cf2251debba61b568416124736de1d5a7ddc8c Mon Sep 17 00:00:00 2001 From: Kurt Roeckx Date: Mon, 6 Jun 2016 22:50:25 +0200 Subject: [PATCH] Avoid creating illegal pointers Found by tis-interpreter Reviewed-by: Rich Salz GH: #1179 --- crypto/bn/bn_lib.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c index ccdefb354f..90df3eee3b 100644 --- a/crypto/bn/bn_lib.c +++ b/crypto/bn/bn_lib.c @@ -565,9 +565,9 @@ BIGNUM *BN_lebin2bn(const unsigned char *s, int len, BIGNUM *ret) if (ret == NULL) return (NULL); bn_check_top(ret); - s += len - 1; + s += len; /* Skip trailing zeroes. */ - for ( ; len > 0 && *s == 0; s--, len--) + for ( ; len > 0 && s[-1] == 0; s--, len--) continue; n = len; if (n == 0) { @@ -584,7 +584,8 @@ BIGNUM *BN_lebin2bn(const unsigned char *s, int len, BIGNUM *ret) ret->neg = 0; l = 0; while (n--) { - l = (l << 8L) | *(s--); + s--; + l = (l << 8L) | *s; if (m-- == 0) { ret->d[--i] = l; l = 0; @@ -610,10 +611,11 @@ int BN_bn2lebinpad(const BIGNUM *a, unsigned char *to, int tolen) /* Add trailing zeroes if necessary */ if (tolen > i) memset(to + i, 0, tolen - i); - to += i - 1; + to += i; while (i--) { l = a->d[i / BN_BYTES]; - *(to--) = (unsigned char)(l >> (8 * (i % BN_BYTES))) & 0xff; + to--; + *to = (unsigned char)(l >> (8 * (i % BN_BYTES))) & 0xff; } return tolen; } -- 2.25.1