From 6a009812b2e249fed01488f6f19f9fbfd9ee74c4 Mon Sep 17 00:00:00 2001 From: Matt Caswell Date: Mon, 10 Aug 2015 12:00:29 +0100 Subject: Check for 0 modulus in BN_MONT_CTX_set The function BN_MONT_CTX_set was assuming that the modulus was non-zero and therefore that |mod->top| > 0. In an error situation that may not be the case and could cause a seg fault. This is a follow on from CVE-2015-1794. Reviewed-by: Richard Levitte --- crypto/bn/bn_mont.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'crypto') diff --git a/crypto/bn/bn_mont.c b/crypto/bn/bn_mont.c index 1580e978ce..d4d817a74f 100644 --- a/crypto/bn/bn_mont.c +++ b/crypto/bn/bn_mont.c @@ -351,6 +351,9 @@ int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx) int ret = 0; BIGNUM *Ri, *R; + if (BN_is_zero(mod)) + return 0; + BN_CTX_start(ctx); if ((Ri = BN_CTX_get(ctx)) == NULL) goto err; -- cgit v1.2.3