diff options
| author | Matt Caswell <matt@openssl.org> | 2018-04-27 17:36:11 +0100 |
|---|---|---|
| committer | Matt Caswell <matt@openssl.org> | 2018-05-03 10:14:12 +0100 |
| commit | b1860d6c71733314417d053a72af66ae72e8268e (patch) | |
| tree | 0dd7cac671060990c58addb98f72c29b87c7dc4c /crypto/bn/bn_mont.c | |
| parent | 4db296d9f0cf2855b358883a55b77a6b6f6848ba (diff) | |
Return an error from BN_mod_inverse if n is 1 (or -1)
Calculating BN_mod_inverse where n is 1 (or -1) doesn't make sense. We
should return an error in that case. Instead we were returning a valid
result with value 0.
Fixes #6004
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6119)
Diffstat (limited to 'crypto/bn/bn_mont.c')
| -rw-r--r-- | crypto/bn/bn_mont.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c index b85a8934c4..5e068c4a1b 100644 --- a/crypto/bn/bn_mont.c +++ b/crypto/bn/bn_mont.c @@ -281,7 +281,9 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) if ((buf[1] = mod->top > 1 ? mod->d[1] : 0)) tmod.top = 2; - if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL) + if (BN_is_one(&tmod)) + BN_zero(Ri); + else if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL) goto err; if (!BN_lshift(Ri, Ri, 2 * BN_BITS2)) goto err; /* R*Ri */ @@ -314,7 +316,9 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) buf[1] = 0; tmod.top = buf[0] != 0 ? 1 : 0; /* Ri = R^-1 mod N */ - if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL) + if (BN_is_one(&tmod)) + BN_zero(Ri); + else if ((BN_mod_inverse(Ri, R, &tmod, ctx)) == NULL) goto err; if (!BN_lshift(Ri, Ri, BN_BITS2)) goto err; /* R*Ri */ |