diff options
| author | Kurt Roeckx <kurt@roeckx.be> | 2016-06-06 22:50:25 +0200 |
|---|---|---|
| committer | Kurt Roeckx <kurt@roeckx.be> | 2016-06-11 16:43:53 +0200 |
| commit | f3cf2251debba61b568416124736de1d5a7ddc8c (patch) | |
| tree | 54b5b682b9f5ed2d371b5473f679af49a6fc2689 | |
| parent | 0a3206539a41f48b24d107449779cdbf5104c1fc (diff) | |
Avoid creating illegal pointers
Found by tis-interpreter
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1179
| -rw-r--r-- | crypto/bn/bn_lib.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c index ccdefb354f..90df3eee3b 100644 --- a/crypto/bn/bn_lib.c +++ b/crypto/bn/bn_lib.c @@ -565,9 +565,9 @@ BIGNUM *BN_lebin2bn(const unsigned char *s, int len, BIGNUM *ret) if (ret == NULL) return (NULL); bn_check_top(ret); - s += len - 1; + s += len; /* Skip trailing zeroes. */ - for ( ; len > 0 && *s == 0; s--, len--) + for ( ; len > 0 && s[-1] == 0; s--, len--) continue; n = len; if (n == 0) { @@ -584,7 +584,8 @@ BIGNUM *BN_lebin2bn(const unsigned char *s, int len, BIGNUM *ret) ret->neg = 0; l = 0; while (n--) { - l = (l << 8L) | *(s--); + s--; + l = (l << 8L) | *s; if (m-- == 0) { ret->d[--i] = l; l = 0; @@ -610,10 +611,11 @@ int BN_bn2lebinpad(const BIGNUM *a, unsigned char *to, int tolen) /* Add trailing zeroes if necessary */ if (tolen > i) memset(to + i, 0, tolen - i); - to += i - 1; + to += i; while (i--) { l = a->d[i / BN_BYTES]; - *(to--) = (unsigned char)(l >> (8 * (i % BN_BYTES))) & 0xff; + to--; + *to = (unsigned char)(l >> (8 * (i % BN_BYTES))) & 0xff; } return tolen; } |