Always check bn_wexpend() return values for failure (CVE-2009-3245).

[openssl.git] / crypto / bn / bn_gf2m.c

diff --git a/crypto/bn/bn_gf2m.c b/crypto/bn/bn_gf2m.c
index 334a314283a2665185ea405bbbfcdab087126322..527b0fa15be51ada3725d3d77704b26e8f8619ff 100644 (file)
--- a/crypto/bn/bn_gf2m.c
+++ b/crypto/bn/bn_gf2m.c
@@ -121,74 +121,12 @@ static const BN_ULONG SQR_tb[16] =
     SQR_tb[(w) >> 12 & 0xF] << 24 | SQR_tb[(w) >>  8 & 0xF] << 16 | \
     SQR_tb[(w) >>  4 & 0xF] <<  8 | SQR_tb[(w)       & 0xF]
 #endif
     SQR_tb[(w) >> 12 & 0xF] << 24 | SQR_tb[(w) >>  8 & 0xF] << 16 | \
     SQR_tb[(w) >>  4 & 0xF] <<  8 | SQR_tb[(w)       & 0xF]
 #endif

-#ifdef SIXTEEN_BIT
-#define SQR1(w) \
-    SQR_tb[(w) >> 12 & 0xF] <<  8 | SQR_tb[(w) >>  8 & 0xF]
-#define SQR0(w) \
-    SQR_tb[(w) >>  4 & 0xF] <<  8 | SQR_tb[(w)       & 0xF]
-#endif
-#ifdef EIGHT_BIT
-#define SQR1(w) \
-    SQR_tb[(w) >>  4 & 0xF]
-#define SQR0(w) \
-    SQR_tb[(w)       & 15]
-#endif

 
 /* Product of two polynomials a, b each with degree < BN_BITS2 - 1,
  * result is a polynomial r with degree < 2 * BN_BITS - 1
  * The caller MUST ensure that the variables have the right amount
  * of space allocated.
  */
 
 /* Product of two polynomials a, b each with degree < BN_BITS2 - 1,
  * result is a polynomial r with degree < 2 * BN_BITS - 1
  * The caller MUST ensure that the variables have the right amount
  * of space allocated.
  */

-#ifdef EIGHT_BIT
-static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const BN_ULONG b)
-       {
-       register BN_ULONG h, l, s;
-       BN_ULONG tab[4], top1b = a >> 7;
-       register BN_ULONG a1, a2;
-
-       a1 = a & (0x7F); a2 = a1 << 1;
-
-       tab[0] = 0; tab[1] = a1; tab[2] = a2; tab[3] = a1^a2;
-
-       s = tab[b      & 0x3]; l  = s;
-       s = tab[b >> 2 & 0x3]; l ^= s << 2; h  = s >> 6;
-       s = tab[b >> 4 & 0x3]; l ^= s << 4; h ^= s >> 4;
-       s = tab[b >> 6      ]; l ^= s << 6; h ^= s >> 2;
-       
-       /* compensate for the top bit of a */
-
-       if (top1b & 01) { l ^= b << 7; h ^= b >> 1; } 
-
-       *r1 = h; *r0 = l;
-       } 
-#endif
-#ifdef SIXTEEN_BIT
-static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const BN_ULONG b)
-       {
-       register BN_ULONG h, l, s;
-       BN_ULONG tab[4], top1b = a >> 15; 
-       register BN_ULONG a1, a2;
-
-       a1 = a & (0x7FFF); a2 = a1 << 1;
-
-       tab[0] = 0; tab[1] = a1; tab[2] = a2; tab[3] = a1^a2;
-
-       s = tab[b      & 0x3]; l  = s;
-       s = tab[b >> 2 & 0x3]; l ^= s <<  2; h  = s >> 14;
-       s = tab[b >> 4 & 0x3]; l ^= s <<  4; h ^= s >> 12;
-       s = tab[b >> 6 & 0x3]; l ^= s <<  6; h ^= s >> 10;
-       s = tab[b >> 8 & 0x3]; l ^= s <<  8; h ^= s >>  8;
-       s = tab[b >>10 & 0x3]; l ^= s << 10; h ^= s >>  6;
-       s = tab[b >>12 & 0x3]; l ^= s << 12; h ^= s >>  4;
-       s = tab[b >>14      ]; l ^= s << 14; h ^= s >>  2;
-
-       /* compensate for the top bit of a */
-
-       if (top1b & 01) { l ^= b << 15; h ^= b >> 1; } 
-
-       *r1 = h; *r0 = l;
-       } 
-#endif

 #ifdef THIRTY_TWO_BIT
 static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const BN_ULONG b)
        {
 #ifdef THIRTY_TWO_BIT
 static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const BN_ULONG b)
        {


@@ -228,7 +166,7 @@ static void bn_GF2m_mul_1x1(BN_ULONG *r1, BN_ULONG *r0, const BN_ULONG a, const
        BN_ULONG tab[16], top3b = a >> 61;
        register BN_ULONG a1, a2, a4, a8;
 
        BN_ULONG tab[16], top3b = a >> 61;
        register BN_ULONG a1, a2, a4, a8;
 

-       a1 = a & (0x1FFFFFFFFFFFFFFF); a2 = a1 << 1; a4 = a2 << 1; a8 = a4 << 1;
+       a1 = a & (0x1FFFFFFFFFFFFFFFULL); a2 = a1 << 1; a4 = a2 << 1; a8 = a4 << 1;

 
        tab[ 0] = 0;     tab[ 1] = a1;       tab[ 2] = a2;       tab[ 3] = a1^a2;
        tab[ 4] = a4;    tab[ 5] = a1^a4;    tab[ 6] = a2^a4;    tab[ 7] = a1^a2^a4;
 
        tab[ 0] = 0;     tab[ 1] = a1;       tab[ 2] = a2;       tab[ 3] = a1^a2;
        tab[ 4] = a4;    tab[ 5] = a1^a4;    tab[ 6] = a2^a4;    tab[ 7] = a1^a2^a4;


@@ -288,10 +226,14 @@ int       BN_GF2m_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
        int i;
        const BIGNUM *at, *bt;
 
        int i;
        const BIGNUM *at, *bt;
 

+       bn_check_top(a);
+       bn_check_top(b);
+

        if (a->top < b->top) { at = b; bt = a; }
        else { at = a; bt = b; }
 
        if (a->top < b->top) { at = b; bt = a; }
        else { at = a; bt = b; }
 

-       bn_wexpand(r, at->top);
+       if(bn_wexpand(r, at->top) == NULL)
+               return 0;

 
        for (i = 0; i < bt->top; i++)
                {
 
        for (i = 0; i < bt->top; i++)
                {


@@ -317,15 +259,20 @@ int       BN_GF2m_add(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
 
 
 /* Performs modular reduction of a and store result in r.  r could be a. */
 
 
 /* Performs modular reduction of a and store result in r.  r could be a. */

-int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[])
+int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const int p[])

        {
        int j, k;
        int n, dN, d0, d1;
        BN_ULONG zz, *z;
        {
        int j, k;
        int n, dN, d0, d1;
        BN_ULONG zz, *z;

-       
+
+       bn_check_top(a);
+

        if (!p[0])
        if (!p[0])

+               {

                /* reduction mod 1 => return 0 */
                /* reduction mod 1 => return 0 */

-               return BN_zero(r);
+               BN_zero(r);
+               return 1;
+               }

 
        /* Since the algorithm does reduction in the r value, if a != r, copy
         * the contents of a into r so we can do reduction in r. 
 
        /* Since the algorithm does reduction in the r value, if a != r, copy
         * the contents of a into r so we can do reduction in r. 


@@ -376,7 +323,11 @@ int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[])
                if (zz == 0) break;
                d1 = BN_BITS2 - d0;
                
                if (zz == 0) break;
                d1 = BN_BITS2 - d0;
                

-               if (d0) z[dN] = (z[dN] << d1) >> d1; /* clear up the top d1 bits */
+               /* clear up the top d1 bits */
+               if (d0)
+                       z[dN] = (z[dN] << d1) >> d1;
+               else
+                       z[dN] = 0;

                z[0] ^= zz; /* reduction t^0 component */
 
                for (k = 1; p[k] != 0; k++)
                z[0] ^= zz; /* reduction t^0 component */
 
                for (k = 1; p[k] != 0; k++)


@@ -397,7 +348,6 @@ int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[])
                }
 
        bn_correct_top(r);
                }
 
        bn_correct_top(r);

-       

        return 1;
        }
 
        return 1;
        }
 


@@ -410,9 +360,11 @@ int BN_GF2m_mod_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[])
 int    BN_GF2m_mod(BIGNUM *r, const BIGNUM *a, const BIGNUM *p)
        {
        int ret = 0;
 int    BN_GF2m_mod(BIGNUM *r, const BIGNUM *a, const BIGNUM *p)
        {
        int ret = 0;

-       const int max = BN_num_bits(p);
-       unsigned int *arr=NULL;
-       if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+       const int max = BN_num_bits(p) + 1;
+       int *arr=NULL;
+       bn_check_top(a);
+       bn_check_top(p);
+       if ((arr = (int *)OPENSSL_malloc(sizeof(int) * max)) == NULL) goto err;

        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {
        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {


@@ -421,7 +373,7 @@ int BN_GF2m_mod(BIGNUM *r, const BIGNUM *a, const BIGNUM *p)
                }
        ret = BN_GF2m_mod_arr(r, a, arr);
        bn_check_top(r);
                }
        ret = BN_GF2m_mod_arr(r, a, arr);
        bn_check_top(r);

-  err:
+err:

        if (arr) OPENSSL_free(arr);
        return ret;
        }
        if (arr) OPENSSL_free(arr);
        return ret;
        }


@@ -430,17 +382,19 @@ int       BN_GF2m_mod(BIGNUM *r, const BIGNUM *a, const BIGNUM *p)
 /* Compute the product of two polynomials a and b, reduce modulo p, and store
  * the result in r.  r could be a or b; a could be b.
  */
 /* Compute the product of two polynomials a and b, reduce modulo p, and store
  * the result in r.  r could be a or b; a could be b.
  */

-int    BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const unsigned int p[], BN_CTX *ctx)
+int    BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const int p[], BN_CTX *ctx)

        {
        int zlen, i, j, k, ret = 0;
        BIGNUM *s;
        BN_ULONG x1, x0, y1, y0, zz[4];
        {
        int zlen, i, j, k, ret = 0;
        BIGNUM *s;
        BN_ULONG x1, x0, y1, y0, zz[4];

-       
+
+       bn_check_top(a);
+       bn_check_top(b);
+

        if (a == b)
                {
                return BN_GF2m_mod_sqr_arr(r, a, p, ctx);
                }
        if (a == b)
                {
                return BN_GF2m_mod_sqr_arr(r, a, p, ctx);
                }

-       

 
        BN_CTX_start(ctx);
        if ((s = BN_CTX_get(ctx)) == NULL) goto err;
 
        BN_CTX_start(ctx);
        if ((s = BN_CTX_get(ctx)) == NULL) goto err;


@@ -469,10 +423,9 @@ int        BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const unsig
                ret = 1;
        bn_check_top(r);
 
                ret = 1;
        bn_check_top(r);
 

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        BN_CTX_end(ctx);
        return ret;

-       

        }
 
 /* Compute the product of two polynomials a and b, reduce modulo p, and store
        }
 
 /* Compute the product of two polynomials a and b, reduce modulo p, and store


@@ -485,9 +438,12 @@ int        BN_GF2m_mod_mul_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const unsig
 int    BN_GF2m_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;
 int    BN_GF2m_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;

-       const int max = BN_num_bits(p);
-       unsigned int *arr=NULL;
-       if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+       const int max = BN_num_bits(p) + 1;
+       int *arr=NULL;
+       bn_check_top(a);
+       bn_check_top(b);
+       bn_check_top(p);
+       if ((arr = (int *)OPENSSL_malloc(sizeof(int) * max)) == NULL) goto err;

        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {
        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {


@@ -496,18 +452,19 @@ int       BN_GF2m_mod_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p
                }
        ret = BN_GF2m_mod_mul_arr(r, a, b, arr, ctx);
        bn_check_top(r);
                }
        ret = BN_GF2m_mod_mul_arr(r, a, b, arr, ctx);
        bn_check_top(r);

-  err:
+err:

        if (arr) OPENSSL_free(arr);
        return ret;
        }
 
 
 /* Square a, reduce the result mod p, and store it in a.  r could be a. */
        if (arr) OPENSSL_free(arr);
        return ret;
        }
 
 
 /* Square a, reduce the result mod p, and store it in a.  r could be a. */

-int    BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[], BN_CTX *ctx)
+int    BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const int p[], BN_CTX *ctx)

        {
        int i, ret = 0;
        BIGNUM *s;
        {
        int i, ret = 0;
        BIGNUM *s;

-       
+
+       bn_check_top(a);

        BN_CTX_start(ctx);
        if ((s = BN_CTX_get(ctx)) == NULL) return 0;
        if (!bn_wexpand(s, 2 * a->top)) goto err;
        BN_CTX_start(ctx);
        if ((s = BN_CTX_get(ctx)) == NULL) return 0;
        if (!bn_wexpand(s, 2 * a->top)) goto err;


@@ -523,7 +480,7 @@ int BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[], BN_C
        if (!BN_GF2m_mod_arr(r, s, p)) goto err;
        bn_check_top(r);
        ret = 1;
        if (!BN_GF2m_mod_arr(r, s, p)) goto err;
        bn_check_top(r);
        ret = 1;

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -537,9 +494,12 @@ int        BN_GF2m_mod_sqr_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[], BN_C
 int    BN_GF2m_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;
 int    BN_GF2m_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;

-       const int max = BN_num_bits(p);
-       unsigned int *arr=NULL;
-       if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+       const int max = BN_num_bits(p) + 1;
+       int *arr=NULL;
+
+       bn_check_top(a);
+       bn_check_top(p);
+       if ((arr = (int *)OPENSSL_malloc(sizeof(int) * max)) == NULL) goto err;

        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {
        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {


@@ -548,7 +508,7 @@ int BN_GF2m_mod_sqr(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                }
        ret = BN_GF2m_mod_sqr_arr(r, a, arr, ctx);
        bn_check_top(r);
                }
        ret = BN_GF2m_mod_sqr_arr(r, a, arr, ctx);
        bn_check_top(r);

-  err:
+err:

        if (arr) OPENSSL_free(arr);
        return ret;
        }
        if (arr) OPENSSL_free(arr);
        return ret;
        }


@@ -564,6 +524,9 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        BIGNUM *b, *c, *u, *v, *tmp;
        int ret = 0;
 
        BIGNUM *b, *c, *u, *v, *tmp;
        int ret = 0;
 

+       bn_check_top(a);
+       bn_check_top(p);
+

        BN_CTX_start(ctx);
        
        b = BN_CTX_get(ctx);
        BN_CTX_start(ctx);
        
        b = BN_CTX_get(ctx);


@@ -573,7 +536,6 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        if (v == NULL) goto err;
 
        if (!BN_one(b)) goto err;
        if (v == NULL) goto err;
 
        if (!BN_one(b)) goto err;

-       if (!BN_zero(c)) goto err;

        if (!BN_GF2m_mod(u, a, p)) goto err;
        if (!BN_copy(v, p)) goto err;
 
        if (!BN_GF2m_mod(u, a, p)) goto err;
        if (!BN_copy(v, p)) goto err;
 


@@ -608,7 +570,7 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        bn_check_top(r);
        ret = 1;
 
        bn_check_top(r);
        ret = 1;
 

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -619,11 +581,12 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
  * function is only provided for convenience; for best performance, use the 
  * BN_GF2m_mod_inv function.
  */
  * function is only provided for convenience; for best performance, use the 
  * BN_GF2m_mod_inv function.
  */

-int BN_GF2m_mod_inv_arr(BIGNUM *r, const BIGNUM *xx, const unsigned int p[], BN_CTX *ctx)
+int BN_GF2m_mod_inv_arr(BIGNUM *r, const BIGNUM *xx, const int p[], BN_CTX *ctx)

        {
        BIGNUM *field;
        int ret = 0;
 
        {
        BIGNUM *field;
        int ret = 0;
 

+       bn_check_top(xx);

        BN_CTX_start(ctx);
        if ((field = BN_CTX_get(ctx)) == NULL) goto err;
        if (!BN_GF2m_arr2poly(p, field)) goto err;
        BN_CTX_start(ctx);
        if ((field = BN_CTX_get(ctx)) == NULL) goto err;
        if (!BN_GF2m_arr2poly(p, field)) goto err;


@@ -631,7 +594,7 @@ int BN_GF2m_mod_inv_arr(BIGNUM *r, const BIGNUM *xx, const unsigned int p[], BN_
        ret = BN_GF2m_mod_inv(r, xx, field, ctx);
        bn_check_top(r);
 
        ret = BN_GF2m_mod_inv(r, xx, field, ctx);
        bn_check_top(r);
 

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -645,7 +608,11 @@ int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x, const BIGNUM *p
        {
        BIGNUM *xinv = NULL;
        int ret = 0;
        {
        BIGNUM *xinv = NULL;
        int ret = 0;

-       
+
+       bn_check_top(y);
+       bn_check_top(x);
+       bn_check_top(p);
+

        BN_CTX_start(ctx);
        xinv = BN_CTX_get(ctx);
        if (xinv == NULL) goto err;
        BN_CTX_start(ctx);
        xinv = BN_CTX_get(ctx);
        if (xinv == NULL) goto err;


@@ -655,7 +622,7 @@ int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x, const BIGNUM *p
        bn_check_top(r);
        ret = 1;
 
        bn_check_top(r);
        ret = 1;
 

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -671,6 +638,10 @@ int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x, const BIGNUM *p
        BIGNUM *a, *b, *u, *v;
        int ret = 0;
 
        BIGNUM *a, *b, *u, *v;
        int ret = 0;
 

+       bn_check_top(y);
+       bn_check_top(x);
+       bn_check_top(p);
+

        BN_CTX_start(ctx);
        
        a = BN_CTX_get(ctx);
        BN_CTX_start(ctx);
        
        a = BN_CTX_get(ctx);


@@ -683,7 +654,6 @@ int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x, const BIGNUM *p
        if (!BN_GF2m_mod(u, y, p)) goto err;
        if (!BN_GF2m_mod(a, x, p)) goto err;
        if (!BN_copy(b, p)) goto err;
        if (!BN_GF2m_mod(u, y, p)) goto err;
        if (!BN_GF2m_mod(a, x, p)) goto err;
        if (!BN_copy(b, p)) goto err;

-       if (!BN_zero(v)) goto err;

        
        while (!BN_is_odd(a))
                {
        
        while (!BN_is_odd(a))
                {


@@ -724,7 +694,7 @@ int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x, const BIGNUM *p
        bn_check_top(r);
        ret = 1;
 
        bn_check_top(r);
        ret = 1;
 

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -737,11 +707,14 @@ int BN_GF2m_mod_div(BIGNUM *r, const BIGNUM *y, const BIGNUM *x, const BIGNUM *p
  * function is only provided for convenience; for best performance, use the 
  * BN_GF2m_mod_div function.
  */
  * function is only provided for convenience; for best performance, use the 
  * BN_GF2m_mod_div function.
  */

-int BN_GF2m_mod_div_arr(BIGNUM *r, const BIGNUM *yy, const BIGNUM *xx, const unsigned int p[], BN_CTX *ctx)
+int BN_GF2m_mod_div_arr(BIGNUM *r, const BIGNUM *yy, const BIGNUM *xx, const int p[], BN_CTX *ctx)

        {
        BIGNUM *field;
        int ret = 0;
 
        {
        BIGNUM *field;
        int ret = 0;
 

+       bn_check_top(yy);
+       bn_check_top(xx);
+

        BN_CTX_start(ctx);
        if ((field = BN_CTX_get(ctx)) == NULL) goto err;
        if (!BN_GF2m_arr2poly(p, field)) goto err;
        BN_CTX_start(ctx);
        if ((field = BN_CTX_get(ctx)) == NULL) goto err;
        if (!BN_GF2m_arr2poly(p, field)) goto err;


@@ -749,7 +722,7 @@ int BN_GF2m_mod_div_arr(BIGNUM *r, const BIGNUM *yy, const BIGNUM *xx, const uns
        ret = BN_GF2m_mod_div(r, yy, xx, field, ctx);
        bn_check_top(r);
 
        ret = BN_GF2m_mod_div(r, yy, xx, field, ctx);
        bn_check_top(r);
 

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -759,17 +732,19 @@ int BN_GF2m_mod_div_arr(BIGNUM *r, const BIGNUM *yy, const BIGNUM *xx, const uns
  * the result in r.  r could be a.
  * Uses simple square-and-multiply algorithm A.5.1 from IEEE P1363.
  */
  * the result in r.  r could be a.
  * Uses simple square-and-multiply algorithm A.5.1 from IEEE P1363.
  */

-int    BN_GF2m_mod_exp_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const unsigned int p[], BN_CTX *ctx)
+int    BN_GF2m_mod_exp_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const int p[], BN_CTX *ctx)

        {
        int ret = 0, i, n;
        BIGNUM *u;
        {
        int ret = 0, i, n;
        BIGNUM *u;

-       
+
+       bn_check_top(a);
+       bn_check_top(b);
+

        if (BN_is_zero(b))
                return(BN_one(r));
 
        if (BN_abs_is_word(b, 1))
                return (BN_copy(r, a) != NULL);
        if (BN_is_zero(b))
                return(BN_one(r));
 
        if (BN_abs_is_word(b, 1))
                return (BN_copy(r, a) != NULL);

-       

 
        BN_CTX_start(ctx);
        if ((u = BN_CTX_get(ctx)) == NULL) goto err;
 
        BN_CTX_start(ctx);
        if ((u = BN_CTX_get(ctx)) == NULL) goto err;


@@ -787,10 +762,8 @@ int        BN_GF2m_mod_exp_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const unsig
                }
        if (!BN_copy(r, u)) goto err;
        bn_check_top(r);
                }
        if (!BN_copy(r, u)) goto err;
        bn_check_top(r);

-

        ret = 1;
        ret = 1;

-
-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -805,9 +778,12 @@ int        BN_GF2m_mod_exp_arr(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const unsig
 int BN_GF2m_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;
 int BN_GF2m_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;

-       const int max = BN_num_bits(p);
-       unsigned int *arr=NULL;
-       if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+       const int max = BN_num_bits(p) + 1;
+       int *arr=NULL;
+       bn_check_top(a);
+       bn_check_top(b);
+       bn_check_top(p);
+       if ((arr = (int *)OPENSSL_malloc(sizeof(int) * max)) == NULL) goto err;

        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {
        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {


@@ -816,7 +792,7 @@ int BN_GF2m_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p
                }
        ret = BN_GF2m_mod_exp_arr(r, a, b, arr, ctx);
        bn_check_top(r);
                }
        ret = BN_GF2m_mod_exp_arr(r, a, b, arr, ctx);
        bn_check_top(r);

-  err:
+err:

        if (arr) OPENSSL_free(arr);
        return ret;
        }
        if (arr) OPENSSL_free(arr);
        return ret;
        }


@@ -825,24 +801,28 @@ int BN_GF2m_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, const BIGNUM *p
  * the result in r.  r could be a.
  * Uses exponentiation as in algorithm A.4.1 from IEEE P1363.
  */
  * the result in r.  r could be a.
  * Uses exponentiation as in algorithm A.4.1 from IEEE P1363.
  */

-int    BN_GF2m_mod_sqrt_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[], BN_CTX *ctx)
+int    BN_GF2m_mod_sqrt_arr(BIGNUM *r, const BIGNUM *a, const int p[], BN_CTX *ctx)

        {
        int ret = 0;
        BIGNUM *u;
 
        {
        int ret = 0;
        BIGNUM *u;
 

+       bn_check_top(a);
+

        if (!p[0])
        if (!p[0])

+               {

                /* reduction mod 1 => return 0 */
                /* reduction mod 1 => return 0 */

-               return BN_zero(r);
-       
+               BN_zero(r);
+               return 1;
+               }
+

        BN_CTX_start(ctx);
        if ((u = BN_CTX_get(ctx)) == NULL) goto err;
        
        BN_CTX_start(ctx);
        if ((u = BN_CTX_get(ctx)) == NULL) goto err;
        

-       if (!BN_zero(u)) goto err;

        if (!BN_set_bit(u, p[0] - 1)) goto err;
        ret = BN_GF2m_mod_exp_arr(r, a, u, p, ctx);
        bn_check_top(r);
 
        if (!BN_set_bit(u, p[0] - 1)) goto err;
        ret = BN_GF2m_mod_exp_arr(r, a, u, p, ctx);
        bn_check_top(r);
 

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -857,18 +837,20 @@ int       BN_GF2m_mod_sqrt_arr(BIGNUM *r, const BIGNUM *a, const unsigned int p[], BN_
 int BN_GF2m_mod_sqrt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;
 int BN_GF2m_mod_sqrt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;

-       const int max = BN_num_bits(p);
-       unsigned int *arr=NULL;
-       if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) * max)) == NULL) goto err;
+       const int max = BN_num_bits(p) + 1;
+       int *arr=NULL;
+       bn_check_top(a);
+       bn_check_top(p);
+       if ((arr = (int *)OPENSSL_malloc(sizeof(int) * max)) == NULL) goto err;

        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {
        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                {

-               BNerr(BN_F_BN_GF2M_MOD_EXP,BN_R_INVALID_LENGTH);
+               BNerr(BN_F_BN_GF2M_MOD_SQRT,BN_R_INVALID_LENGTH);

                goto err;
                }
        ret = BN_GF2m_mod_sqrt_arr(r, a, arr, ctx);
        bn_check_top(r);
                goto err;
                }
        ret = BN_GF2m_mod_sqrt_arr(r, a, arr, ctx);
        bn_check_top(r);

-  err:
+err:

        if (arr) OPENSSL_free(arr);
        return ret;
        }
        if (arr) OPENSSL_free(arr);
        return ret;
        }


@@ -876,15 +858,19 @@ int BN_GF2m_mod_sqrt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
 /* Find r such that r^2 + r = a mod p.  r could be a. If no r exists returns 0.
  * Uses algorithms A.4.7 and A.4.6 from IEEE P1363.
  */
 /* Find r such that r^2 + r = a mod p.  r could be a. If no r exists returns 0.
  * Uses algorithms A.4.7 and A.4.6 from IEEE P1363.
  */

-int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const unsigned int p[], BN_CTX *ctx)
+int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const int p[], BN_CTX *ctx)

        {
        {

-       int ret = 0, count = 0;
-       unsigned int j;
+       int ret = 0, count = 0, j;

        BIGNUM *a, *z, *rho, *w, *w2, *tmp;
 
        BIGNUM *a, *z, *rho, *w, *w2, *tmp;
 

+       bn_check_top(a_);
+

        if (!p[0])
        if (!p[0])

+               {

                /* reduction mod 1 => return 0 */
                /* reduction mod 1 => return 0 */

-               return BN_zero(r);
+               BN_zero(r);
+               return 1;
+               }

 
        BN_CTX_start(ctx);
        a = BN_CTX_get(ctx);
 
        BN_CTX_start(ctx);
        a = BN_CTX_get(ctx);


@@ -896,7 +882,8 @@ int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const unsigned int p
        
        if (BN_is_zero(a))
                {
        
        if (BN_is_zero(a))
                {

-               ret = BN_zero(r);
+               BN_zero(r);
+               ret = 1;

                goto err;
                }
 
                goto err;
                }
 


@@ -922,7 +909,7 @@ int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const unsigned int p
                        {
                        if (!BN_rand(rho, p[0], 0, 0)) goto err;
                        if (!BN_GF2m_mod_arr(rho, rho, p)) goto err;
                        {
                        if (!BN_rand(rho, p[0], 0, 0)) goto err;
                        if (!BN_GF2m_mod_arr(rho, rho, p)) goto err;

-                       if (!BN_zero(z)) goto err;
+                       BN_zero(z);

                        if (!BN_copy(w, rho)) goto err;
                        for (j = 1; j <= p[0] - 1; j++)
                                {
                        if (!BN_copy(w, rho)) goto err;
                        for (j = 1; j <= p[0] - 1; j++)
                                {


@@ -943,14 +930,18 @@ int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const unsigned int p
        
        if (!BN_GF2m_mod_sqr_arr(w, z, p, ctx)) goto err;
        if (!BN_GF2m_add(w, z, w)) goto err;
        
        if (!BN_GF2m_mod_sqr_arr(w, z, p, ctx)) goto err;
        if (!BN_GF2m_add(w, z, w)) goto err;

-       if (BN_GF2m_cmp(w, a)) goto err;
+       if (BN_GF2m_cmp(w, a))
+               {
+               BNerr(BN_F_BN_GF2M_MOD_SOLVE_QUAD_ARR, BN_R_NO_SOLUTION);
+               goto err;
+               }

 
        if (!BN_copy(r, z)) goto err;
        bn_check_top(r);
 
        ret = 1;
 
 
        if (!BN_copy(r, z)) goto err;
        bn_check_top(r);
 
        ret = 1;
 

-  err:
+err:

        BN_CTX_end(ctx);
        return ret;
        }
        BN_CTX_end(ctx);
        return ret;
        }


@@ -964,9 +955,11 @@ int BN_GF2m_mod_solve_quad_arr(BIGNUM *r, const BIGNUM *a_, const unsigned int p
 int BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;
 int BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
        {
        int ret = 0;

-       const int max = BN_num_bits(p);
-       unsigned int *arr=NULL;
-       if ((arr = (unsigned int *)OPENSSL_malloc(sizeof(unsigned int) *
+       const int max = BN_num_bits(p) + 1;
+       int *arr=NULL;
+       bn_check_top(a);
+       bn_check_top(p);
+       if ((arr = (int *)OPENSSL_malloc(sizeof(int) *

                                                max)) == NULL) goto err;
        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)
                                                max)) == NULL) goto err;
        ret = BN_GF2m_poly2arr(p, arr, max);
        if (!ret || ret > max)


@@ -976,26 +969,23 @@ int BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *
                }
        ret = BN_GF2m_mod_solve_quad_arr(r, a, arr, ctx);
        bn_check_top(r);
                }
        ret = BN_GF2m_mod_solve_quad_arr(r, a, arr, ctx);
        bn_check_top(r);

-  err:
+err:

        if (arr) OPENSSL_free(arr);
        return ret;
        }
 
 /* Convert the bit-string representation of a polynomial
        if (arr) OPENSSL_free(arr);
        return ret;
        }
 
 /* Convert the bit-string representation of a polynomial

- * ( \sum_{i=0}^n a_i * x^i , where a_0 is *not* zero) into an array
- * of integers corresponding to the bits with non-zero coefficient.
+ * ( \sum_{i=0}^n a_i * x^i) into an array of integers corresponding 
+ * to the bits with non-zero coefficient.  Array is terminated with -1.

  * Up to max elements of the array will be filled.  Return value is total
  * Up to max elements of the array will be filled.  Return value is total

- * number of coefficients that would be extracted if array was large enough.
+ * number of array elements that would be filled if array was large enough.

  */
  */

-int BN_GF2m_poly2arr(const BIGNUM *a, unsigned int p[], int max)
+int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max)

        {
        int i, j, k = 0;
        BN_ULONG mask;
 
        {
        int i, j, k = 0;
        BN_ULONG mask;
 

-       if (BN_is_zero(a) || !BN_is_bit_set(a, 0))
-               /* a_0 == 0 => return error (the unsigned int array
-                * must be terminated by 0)
-                */
+       if (BN_is_zero(a))

                return 0;
 
        for (i = a->top - 1; i >= 0; i--)
                return 0;
 
        for (i = a->top - 1; i >= 0; i--)


@@ -1015,24 +1005,30 @@ int BN_GF2m_poly2arr(const BIGNUM *a, unsigned int p[], int max)
                        }
                }
 
                        }
                }
 

+       if (k < max) {
+               p[k] = -1;
+               k++;
+       }
+

        return k;
        }
 
 /* Convert the coefficient array representation of a polynomial to a 
        return k;
        }
 
 /* Convert the coefficient array representation of a polynomial to a 

- * bit-string.  The array must be terminated by 0.
+ * bit-string.  The array must be terminated by -1.

  */
  */

-int BN_GF2m_arr2poly(const unsigned int p[], BIGNUM *a)
+int BN_GF2m_arr2poly(const int p[], BIGNUM *a)

        {
        int i;
 
        {
        int i;
 

+       bn_check_top(a);

        BN_zero(a);
        BN_zero(a);

-       for (i = 0; p[i] != 0; i++)
+       for (i = 0; p[i] != -1; i++)

                {
                {

-               BN_set_bit(a, p[i]);
+               if (BN_set_bit(a, p[i]) == 0)
+                       return 0;

                }
                }

-       BN_set_bit(a, 0);

        bn_check_top(a);
        bn_check_top(a);

-       
+

        return 1;
        }
 
        return 1;
        }