From f91e026e38321d0c154f535ecd5af09e424e7f1b Mon Sep 17 00:00:00 2001 From: Bernd Edlinger Date: Thu, 29 Mar 2018 11:27:29 +0200 Subject: Fix a possible crash in BN_from_montgomery_word Thanks to Darovskikh Andrei for for reporting this issue. Fixes: #5785 Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/5793) --- test/bntest.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) (limited to 'test') diff --git a/test/bntest.c b/test/bntest.c index d6696e672e..d5b5e0494e 100644 --- a/test/bntest.c +++ b/test/bntest.c @@ -408,9 +408,21 @@ static int test_modexp_mont5(void) BN_free(b); b = BN_dup(a); BN_MONT_CTX_set(mont, n, ctx); - BN_mod_mul_montgomery(c, a, a, mont, ctx); - BN_mod_mul_montgomery(d, a, b, mont, ctx); - if (!TEST_BN_eq(c, d)) + if (!TEST_true(BN_mod_mul_montgomery(c, a, a, mont, ctx)) + || !TEST_true(BN_mod_mul_montgomery(d, a, b, mont, ctx)) + || !TEST_BN_eq(c, d)) + goto err; + + /* Regression test for bug in BN_from_montgomery_word */ + BN_hex2bn(&a, + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"); + BN_hex2bn(&n, + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF" + "FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"); + BN_MONT_CTX_set(mont, n, ctx); + if (!TEST_false(BN_mod_mul_montgomery(d, a, a, mont, ctx))) goto err; /* Regression test for bug in rsaz_1024_mul_avx2 */ -- cgit v1.2.3