diff options
| author | Andy Polyakov <appro@openssl.org> | 2015-06-11 00:18:01 +0200 |
|---|---|---|
| committer | Andy Polyakov <appro@openssl.org> | 2015-06-11 13:34:13 +0200 |
| commit | 4924b37ee01f71ae19c94a8934b80eeb2f677932 (patch) | |
| tree | 0d15be643e1a0df35c169dbf85de389ed0da2b30 | |
| parent | 59302b600e8d5b77ef144e447bb046fd7ab72686 (diff) | |
bn/bn_gf2m.c: avoid infinite loop wich malformed ECParamters.
CVE-2015-1788
Reviewed-by: Matt Caswell <matt@openssl.org>
| -rw-r--r-- | crypto/bn/bn_gf2m.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/crypto/bn/bn_gf2m.c b/crypto/bn/bn_gf2m.c index 73e1e8f11b..cd137c3649 100644 --- a/crypto/bn/bn_gf2m.c +++ b/crypto/bn/bn_gf2m.c @@ -691,9 +691,10 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) } # else { - int i, ubits = BN_num_bits(u), vbits = BN_num_bits(v), /* v is copy - * of p */ - top = p->top; + int i; + int ubits = BN_num_bits(u); + int vbits = BN_num_bits(v); /* v is copy of p */ + int top = p->top; BN_ULONG *udp, *bdp, *vdp, *cdp; bn_wexpand(u, top); @@ -737,8 +738,12 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) ubits--; } - if (ubits <= BN_BITS2 && udp[0] == 1) - break; + if (ubits <= BN_BITS2) { + if (udp[0] == 0) /* poly was reducible */ + goto err; + if (udp[0] == 1) + break; + } if (ubits < vbits) { i = ubits; |