BN_one() uses the expand function which calls malloc which may fail.
All other places that reference BN_one() check the return value.
The issue is triggered by a memory allocation failure.
Detected by PR #18355
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/18697)
(cherry picked from commit
7fe7cc57af3db1e497877f0329ba17609b2efc8b)
if (R == NULL)
goto err;
- BN_one(X);
+ if (!BN_one(X))
+ goto err;
BN_zero(Y);
if (BN_copy(B, a) == NULL)
goto err;
if (R == NULL)
goto err;
- BN_one(X);
+ if (!BN_one(X))
+ goto err;
BN_zero(Y);
if (BN_copy(B, a) == NULL)
goto err;