Fix a buffer overflow in BN_add_word which would occur when certain valuesOPENBSD_5_2

are added to a single word bignum.

from markus@
ok djm@

1 files changed, 8 insertions, 17 deletions

diff --git a/src/lib/libssl/src/crypto/bn/bn_word.c b/src/lib/libssl/src/crypto/bn/bn_word.c
index ee7b87c45c..de83a15b99 100644
--- a/src/lib/libssl/src/crypto/bn/bn_word.c
+++ b/src/lib/libssl/src/crypto/bn/bn_word.c
@@ -144,26 +144,17 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
                         a->neg=!(a->neg);
                 return(i);
                 }
-        /* Only expand (and risk failing) if it's possibly necessary */
-        if (((BN_ULONG)(a->d[a->top - 1] + 1) == 0) &&
-                        (bn_wexpand(a,a->top+1) == NULL))
-                return(0);
-        i=0;
-        for (;;)
+        for (i=0;w!=0 && i<a->top;i++)
                 {
-                if (i >= a->top)
-                        l=w;
-                else
-                        l=(a->d[i]+w)&BN_MASK2;
-                a->d[i]=l;
-                if (w > l)
-                        w=1;
-                else
-                        break;
-                i++;
+                a->d[i] = l = (a->d[i]+w)&BN_MASK2;
+                w = (w>l)?1:0;
                 }
-        if (i >= a->top)
+        if (w && i==a->top)
+                {
+                if (bn_wexpand(a,a->top+1) == NULL) return 0;
                 a->top++;
+                a->d[i]=w;
+                }
         bn_check_top(a);
         return(1);
         }