From: Kurt Roeckx <kurt@roeckx.be>
Date: Sat, 21 May 2016 14:32:15 +0000 (+0200)
Subject: Avoid creating an illegal pointer
X-Git-Tag: OpenSSL_1_1_0-pre6~743
X-Git-Url: https://git.openssl.org/gitweb/?a=commitdiff_plain;ds=sidebyside;h=acc600928dfddebb6f0dc5a44dee35339e8820fb;p=openssl.git

Avoid creating an illegal pointer

Found by tis-interpreter

Reviewed-by: Rich Salz <rsalz@openssl.org>

GH: #1106
---

diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c
index a456ce8ce0..eef1b878c8 100644
--- a/crypto/bn/bn_div.c
+++ b/crypto/bn/bn_div.c
@@ -278,6 +278,9 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
             res->top--;
     }
 
+    /* Increase the resp pointer so that we never create an invalid pointer. */
+    resp++;
+
     /*
      * if res->top == 0 then clear the neg value otherwise decrease the resp
      * pointer
@@ -287,7 +290,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
     else
         resp--;
 
-    for (i = 0; i < loop - 1; i++, wnump--, resp--) {
+    for (i = 0; i < loop - 1; i++, wnump--) {
         BN_ULONG q, l0;
         /*
          * the first part of the loop uses the top two words of snum and sdiv
@@ -393,6 +396,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
                 (*wnump)++;
         }
         /* store part of the result */
+        resp--;
         *resp = q;
     }
     bn_correct_top(snum);