diff options
author | Bodo Möller <bodo@openssl.org> | 2010-02-23 10:36:41 +0000 |
---|---|---|
committer | Bodo Möller <bodo@openssl.org> | 2010-02-23 10:36:41 +0000 |
commit | 3e4da3f7cbb728cf6574c164954c45070c1776a6 (patch) | |
tree | adeb2cc0b208a0966b130a253a3b820cc90f540e /crypto/bn | |
parent | 53b5d04715b6718bb4e609b7bd887495a480d8e5 (diff) |
Always check bn_wexpend() return values for failure (CVE-2009-3245).
(The CHANGES entry covers the change from PR #2111 as well, submitted by
Martin Olsson.)
Submitted by: Neel Mehta
Diffstat (limited to 'crypto/bn')
-rw-r--r-- | crypto/bn/bn_div.c | 2 | ||||
-rw-r--r-- | crypto/bn/bn_gf2m.c | 3 |
2 files changed, 3 insertions, 2 deletions
diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c index 5ea0d6510f..7c35545354 100644 --- a/crypto/bn/bn_div.c +++ b/crypto/bn/bn_div.c @@ -102,7 +102,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, /* The next 2 are needed so we can do a dv->d[0]|=1 later * since BN_lshift1 will only work once there is a value :-) */ BN_zero(dv); - bn_wexpand(dv,1); + if(bn_wexpand(dv,1) == NULL) goto end; dv->top=1; if (!BN_lshift(D,D,nm-nd)) goto end; diff --git a/crypto/bn/bn_gf2m.c b/crypto/bn/bn_gf2m.c index 306f029f27..ae642ccb39 100644 --- a/crypto/bn/bn_gf2m.c +++ b/crypto/bn/bn_gf2m.c @@ -294,7 +294,8 @@ int BN_GF2m_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b) if (a->top < b->top) { at = b; bt = a; } else { at = a; bt = b; } - bn_wexpand(r, at->top); + if(bn_wexpand(r, at->top) == NULL) + return 0; for (i = 0; i < bt->top; i++) { |