bn/bn_gf2m.c: avoid infinite loop wich malformed ECParamters.
authorAndy Polyakov <appro@openssl.org>
Wed, 10 Jun 2015 22:18:01 +0000 (00:18 +0200)
committerAndy Polyakov <appro@openssl.org>
Thu, 11 Jun 2015 11:34:13 +0000 (13:34 +0200)
CVE-2015-1788

Reviewed-by: Matt Caswell <matt@openssl.org>
crypto/bn/bn_gf2m.c

index 73e1e8f..cd137c3 100644 (file)
@@ -691,9 +691,10 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
     }
 # else
     {
-        int i, ubits = BN_num_bits(u), vbits = BN_num_bits(v), /* v is copy
-                                                                * of p */
-            top = p->top;
+        int i;
+        int ubits = BN_num_bits(u);
+        int vbits = BN_num_bits(v); /* v is copy of p */
+        int top = p->top;
         BN_ULONG *udp, *bdp, *vdp, *cdp;
 
         bn_wexpand(u, top);
@@ -737,8 +738,12 @@ int BN_GF2m_mod_inv(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx)
                 ubits--;
             }
 
-            if (ubits <= BN_BITS2 && udp[0] == 1)
-                break;
+            if (ubits <= BN_BITS2) {
+                if (udp[0] == 0) /* poly was reducible */
+                    goto err;
+                if (udp[0] == 1)
+                    break;
+            }
 
             if (ubits < vbits) {
                 i = ubits;