Update from 1.0.0-stable.

[openssl.git] / crypto / bn / bn_div.c

diff --git a/crypto/bn/bn_div.c b/crypto/bn/bn_div.c
index 68ff960aef551bd3b2e56d80646e41034518b2dc..899d07ca2420e208ca893e52bf8ce46138744313 100644 (file)
--- a/crypto/bn/bn_div.c
+++ b/crypto/bn/bn_div.c
@@ -181,12 +181,11 @@ static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
 int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
           BN_CTX *ctx)
        {
-       int norm_shift,i;
-       size_t loop;
+       int norm_shift,i,loop;
        BIGNUM *tmp,wnum,*snum,*sdiv,*res;
        BN_ULONG *resp,*wnump;
        BN_ULONG d0,d1;
-       size_t num_n,div_n;
+       int num_n,div_n;
 
        /* Invalid zero-padding would have particularly bad consequences
         * in the case of 'num', so don't just rely on bn_check_top() for this one
@@ -230,7 +229,8 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
        if (dv == NULL)
                res=BN_CTX_get(ctx);
        else    res=dv;
-       if (sdiv == NULL || res == NULL) goto err;
+       if (sdiv == NULL || res == NULL || tmp == NULL || snum == NULL)
+               goto err;
 
        /* First we normalise the numbers */
        norm_shift=BN_BITS2-((BN_num_bits(divisor))%BN_BITS2);
@@ -266,7 +266,7 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
        resp= &(res->d[loop-1]);
 
        /* space for temp */
-       if (!bn_wexpand(tmp, div_n+1)) goto err;
+       if (!bn_wexpand(tmp,(div_n+1))) goto err;
 
        if (BN_ucmp(&wnum,sdiv) >= 0)
                {
@@ -430,7 +430,7 @@ static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
        BIGNUM *tmp,wnum,*snum,*sdiv,*res;
        BN_ULONG *resp,*wnump;
        BN_ULONG d0,d1;
-       size_t num_n,div_n;
+       int num_n,div_n;
 
        bn_check_top(dv);
        bn_check_top(rm);
@@ -499,12 +499,12 @@ static int BN_div_no_branch(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num,
 
        /* Setup to 'res' */
        res->neg= (num->neg^divisor->neg);
-       if (!bn_wexpand(res,loop+1U)) goto err;
+       if (!bn_wexpand(res,(loop+1))) goto err;
        res->top=loop-1;
        resp= &(res->d[loop-1]);
 
        /* space for temp */
-       if (!bn_wexpand(tmp,div_n+1U)) goto err;
+       if (!bn_wexpand(tmp,(div_n+1))) goto err;
 
        /* if res->top == 0 then clear the neg value otherwise decrease
         * the resp pointer */