From acc600928dfddebb6f0dc5a44dee35339e8820fb Mon Sep 17 00:00:00 2001 From: Kurt Roeckx Date: Sat, 21 May 2016 16:32:15 +0200 Subject: [PATCH] Avoid creating an illegal pointer Found by tis-interpreter Reviewed-by: Rich Salz GH: #1106 --- crypto/bn/bn_div.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c index a456ce8ce0..eef1b878c8 100644 --- a/crypto/bn/bn_div.c +++ b/crypto/bn/bn_div.c @@ -278,6 +278,9 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, res->top--; } + /* Increase the resp pointer so that we never create an invalid pointer. */ + resp++; + /* * if res->top == 0 then clear the neg value otherwise decrease the resp * pointer @@ -287,7 +290,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, else resp--; - for (i = 0; i < loop - 1; i++, wnump--, resp--) { + for (i = 0; i < loop - 1; i++, wnump--) { BN_ULONG q, l0; /* * the first part of the loop uses the top two words of snum and sdiv @@ -393,6 +396,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor, (*wnump)++; } /* store part of the result */ + resp--; *resp = q; } bn_correct_top(snum); -- GitLab