http://openssl.org/news/patch-CVE-2007-3108.txt; ok pval, deraadt

2 files changed, 130 insertions, 26 deletions

diff --git a/src/lib/libcrypto/bn/bn_mont.c b/src/lib/libcrypto/bn/bn_mont.c
index 3572e5a690..726d5f2b1b 100644
--- a/src/lib/libcrypto/bn/bn_mont.c
+++ b/src/lib/libcrypto/bn/bn_mont.c
@@ -122,7 +122,6 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
 
         max=(nl+al+1); /* allow for overflow (no?) XXX */
         if (bn_wexpand(r,max) == NULL) goto err;
-        if (bn_wexpand(ret,max) == NULL) goto err;
 
         r->neg=a->neg^n->neg;
         np=n->d;
@@ -174,19 +173,70 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
                 }
         bn_fix_top(r);
         
-        /* mont->ri will be a multiple of the word size */
-#if 0
-        BN_rshift(ret,r,mont->ri);
-#else
-        ret->neg = r->neg;
-        x=ri;
+        /* mont->ri will be a multiple of the word size and below code
+         * is kind of BN_rshift(ret,r,mont->ri) equivalent */
+        if (r->top <= ri)
+                {
+                ret->top=0;
+                retn=1;
+                goto err;
+                }
+        al=r->top-ri;
+
+# define BRANCH_FREE 1
+# if BRANCH_FREE
+        if (bn_wexpand(ret,ri) == NULL) goto err;
+        x=0-(((al-ri)>>(sizeof(al)*8-1))&1);
+        ret->top=x=(ri&~x)|(al&x);      /* min(ri,al) */
+        ret->neg=r->neg;
+
         rp=ret->d;
-        ap= &(r->d[x]);
-        if (r->top < x)
-                al=0;
-        else
-                al=r->top-x;
+        ap=&(r->d[ri]);
+
+        {
+        size_t m1,m2;
+
+        v=bn_sub_words(rp,ap,np,ri);
+        /* this ----------------^^ works even in al<ri case
+         * thanks to zealous zeroing of top of the vector in the
+         * beginning. */
+
+        /* if (al==ri && !v) || al>ri) nrp=rp; else nrp=ap; */
+        /* in other words if subtraction result is real, then
+         * trick unconditional memcpy below to perform in-place
+         * "refresh" instead of actual copy. */
+        m1=0-(size_t)(((al-ri)>>(sizeof(al)*8-1))&1);   /* al<ri */
+        m2=0-(size_t)(((ri-al)>>(sizeof(al)*8-1))&1);   /* al>ri */
+        m1|=m2;                 /* (al!=ri) */
+        m1|=(0-(size_t)v);      /* (al!=ri || v) */
+        m1&=~m2;                /* (al!=ri || v) && !al>ri */
+        nrp=(BN_ULONG *)(((size_t)rp&~m1)|((size_t)ap&m1));
+        }
+
+        /* 'i<ri' is chosen to eliminate dependency on input data, even
+         * though it results in redundant copy in al<ri case. */
+        for (i=0,ri-=4; i<ri; i+=4)
+                {
+                BN_ULONG t1,t2,t3,t4;
+                
+                t1=nrp[i+0];
+                t2=nrp[i+1];
+                t3=nrp[i+2];    ap[i+0]=0;
+                t4=nrp[i+3];    ap[i+1]=0;
+                rp[i+0]=t1;     ap[i+2]=0;
+                rp[i+1]=t2;     ap[i+3]=0;
+                rp[i+2]=t3;
+                rp[i+3]=t4;
+                }
+        for (ri+=4; i<ri; i++)
+                rp[i]=nrp[i], ap[i]=0;
+# else
+        if (bn_wexpand(ret,al) == NULL) goto err;
         ret->top=al;
+        ret->neg=r->neg;
+
+        rp=ret->d;
+        ap=&(r->d[ri]);
         al-=4;
         for (i=0; i<al; i+=4)
                 {
@@ -204,7 +254,7 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
         al+=4;
         for (; i<al; i++)
                 rp[i]=ap[i];
-#endif
+# endif
 #else /* !MONT_WORD */ 
         BIGNUM *t1,*t2;
 
@@ -224,10 +274,12 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
         if (!BN_rshift(ret,t2,mont->ri)) goto err;
 #endif /* MONT_WORD */
 
+#if !defined(BRANCH_FREE) || BRANCH_FREE==0
         if (BN_ucmp(ret, &(mont->N)) >= 0)
                 {
                 if (!BN_usub(ret,ret,&(mont->N))) goto err;
                 }
+#endif
         retn=1;
  err:
         BN_CTX_end(ctx);
diff --git a/src/lib/libssl/src/crypto/bn/bn_mont.c b/src/lib/libssl/src/crypto/bn/bn_mont.c
index 3572e5a690..726d5f2b1b 100644
--- a/src/lib/libssl/src/crypto/bn/bn_mont.c
+++ b/src/lib/libssl/src/crypto/bn/bn_mont.c
@@ -122,7 +122,6 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
 
         max=(nl+al+1); /* allow for overflow (no?) XXX */
         if (bn_wexpand(r,max) == NULL) goto err;
-        if (bn_wexpand(ret,max) == NULL) goto err;
 
         r->neg=a->neg^n->neg;
         np=n->d;
@@ -174,19 +173,70 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
                 }
         bn_fix_top(r);
         
-        /* mont->ri will be a multiple of the word size */
-#if 0
-        BN_rshift(ret,r,mont->ri);
-#else
-        ret->neg = r->neg;
-        x=ri;
+        /* mont->ri will be a multiple of the word size and below code
+         * is kind of BN_rshift(ret,r,mont->ri) equivalent */
+        if (r->top <= ri)
+                {
+                ret->top=0;
+                retn=1;
+                goto err;
+                }
+        al=r->top-ri;
+
+# define BRANCH_FREE 1
+# if BRANCH_FREE
+        if (bn_wexpand(ret,ri) == NULL) goto err;
+        x=0-(((al-ri)>>(sizeof(al)*8-1))&1);
+        ret->top=x=(ri&~x)|(al&x);      /* min(ri,al) */
+        ret->neg=r->neg;
+
         rp=ret->d;
-        ap= &(r->d[x]);
-        if (r->top < x)
-                al=0;
-        else
-                al=r->top-x;
+        ap=&(r->d[ri]);
+
+        {
+        size_t m1,m2;
+
+        v=bn_sub_words(rp,ap,np,ri);
+        /* this ----------------^^ works even in al<ri case
+         * thanks to zealous zeroing of top of the vector in the
+         * beginning. */
+
+        /* if (al==ri && !v) || al>ri) nrp=rp; else nrp=ap; */
+        /* in other words if subtraction result is real, then
+         * trick unconditional memcpy below to perform in-place
+         * "refresh" instead of actual copy. */
+        m1=0-(size_t)(((al-ri)>>(sizeof(al)*8-1))&1);   /* al<ri */
+        m2=0-(size_t)(((ri-al)>>(sizeof(al)*8-1))&1);   /* al>ri */
+        m1|=m2;                 /* (al!=ri) */
+        m1|=(0-(size_t)v);      /* (al!=ri || v) */
+        m1&=~m2;                /* (al!=ri || v) && !al>ri */
+        nrp=(BN_ULONG *)(((size_t)rp&~m1)|((size_t)ap&m1));
+        }
+
+        /* 'i<ri' is chosen to eliminate dependency on input data, even
+         * though it results in redundant copy in al<ri case. */
+        for (i=0,ri-=4; i<ri; i+=4)
+                {
+                BN_ULONG t1,t2,t3,t4;
+                
+                t1=nrp[i+0];
+                t2=nrp[i+1];
+                t3=nrp[i+2];    ap[i+0]=0;
+                t4=nrp[i+3];    ap[i+1]=0;
+                rp[i+0]=t1;     ap[i+2]=0;
+                rp[i+1]=t2;     ap[i+3]=0;
+                rp[i+2]=t3;
+                rp[i+3]=t4;
+                }
+        for (ri+=4; i<ri; i++)
+                rp[i]=nrp[i], ap[i]=0;
+# else
+        if (bn_wexpand(ret,al) == NULL) goto err;
         ret->top=al;
+        ret->neg=r->neg;
+
+        rp=ret->d;
+        ap=&(r->d[ri]);
         al-=4;
         for (i=0; i<al; i+=4)
                 {
@@ -204,7 +254,7 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
         al+=4;
         for (; i<al; i++)
                 rp[i]=ap[i];
-#endif
+# endif
 #else /* !MONT_WORD */ 
         BIGNUM *t1,*t2;
 
@@ -224,10 +274,12 @@ int BN_from_montgomery(BIGNUM *ret, const BIGNUM *a, BN_MONT_CTX *mont,
         if (!BN_rshift(ret,t2,mont->ri)) goto err;
 #endif /* MONT_WORD */
 
+#if !defined(BRANCH_FREE) || BRANCH_FREE==0
         if (BN_ucmp(ret, &(mont->N)) >= 0)
                 {
                 if (!BN_usub(ret,ret,&(mont->N))) goto err;
                 }
+#endif
         retn=1;
  err:
         BN_CTX_end(ctx);