diff options
| author | Kurt Roeckx <kurt@roeckx.be> | 2016-05-21 16:32:15 +0200 |
|---|---|---|
| committer | Kurt Roeckx <kurt@roeckx.be> | 2016-05-22 12:05:13 +0200 |
| commit | acc600928dfddebb6f0dc5a44dee35339e8820fb (patch) | |
| tree | e81a99d267e3f5519515140f7794014b72502870 /crypto/bn/bn_div.c | |
| parent | 169a8e391e2956687e9f148719687a5ff6ffaa39 (diff) | |
Avoid creating an illegal pointer
Found by tis-interpreter
Reviewed-by: Rich Salz <rsalz@openssl.org>
GH: #1106
Diffstat (limited to 'crypto/bn/bn_div.c')
| -rw-r--r-- | crypto/bn/bn_div.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c index a456ce8ce0..eef1b878c8 100644 --- a/crypto/bn/bn_div.c +++ b/crypto/bn/bn_div.c @@ -278,6 +278,9 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, res->top--; } + /* Increase the resp pointer so that we never create an invalid pointer. */ + resp++; + /* * if res->top == 0 then clear the neg value otherwise decrease the resp * pointer @@ -287,7 +290,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, else resp--; - for (i = 0; i < loop - 1; i++, wnump--, resp--) { + for (i = 0; i < loop - 1; i++, wnump--) { BN_ULONG q, l0; /* * the first part of the loop uses the top two words of snum and sdiv @@ -393,6 +396,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, (*wnump)++; } /* store part of the result */ + resp--; *resp = q; } bn_correct_top(snum); |