bug fix: bn_sqr_recursive output is twice its input size.

diff --git a/CHANGES b/CHANGES
index d7195d9..db742fc 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -12,6 +12,9 @@
          *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
          +) applies to 0.9.7 only
 
+  *) BN_sqr() bug fix.
+     [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>]
+
   *) Make it possible to unload ranges of ERR strings with a new
      "ERR_unload_strings" function.
      [Geoff Thorpe]

diff --git a/crypto/bn/bn_sqr.c b/crypto/bn/bn_sqr.c
index b75e619..c1d0cca 100644 (file)
--- a/crypto/bn/bn_sqr.c
+++ b/crypto/bn/bn_sqr.c
@@ -245,7 +245,7 @@ void bn_sqr_recursive(BN_ULONG *r, const BN_ULONG *a, int n2, BN_ULONG *t)
        if (!zero)
                bn_sqr_recursive(&(t[n2]),t,n,p);
        else
-               memset(&(t[n2]),0,n*sizeof(BN_ULONG));
+               memset(&(t[n2]),0,n2*sizeof(BN_ULONG));
        bn_sqr_recursive(r,a,n,p);
        bn_sqr_recursive(&(r[n2]),&(a[n]),n,p);