Add extra calls to bn_fix_top() in BN_cmp(), since some functions may

leave an invalid BN.

ok markus@ deraadt@

2 files changed, 6 insertions, 0 deletions

diff --git a/src/lib/libcrypto/bn/bn_lib.c b/src/lib/libcrypto/bn/bn_lib.c
index 463463cfcb..5e530d9474 100644
--- a/src/lib/libcrypto/bn/bn_lib.c
+++ b/src/lib/libcrypto/bn/bn_lib.c
@@ -702,6 +702,9 @@ int BN_cmp(const BIGNUM *a, const BIGNUM *b)
                 { gt=1; lt= -1; }
         else    { gt= -1; lt=1; }
 
+        bn_fix_top(a);
+        bn_fix_top(b);
+
         if (a->top > b->top) return(gt);
         if (a->top < b->top) return(lt);
         for (i=a->top-1; i>=0; i--)
diff --git a/src/lib/libssl/src/crypto/bn/bn_lib.c b/src/lib/libssl/src/crypto/bn/bn_lib.c
index 463463cfcb..5e530d9474 100644
--- a/src/lib/libssl/src/crypto/bn/bn_lib.c
+++ b/src/lib/libssl/src/crypto/bn/bn_lib.c
@@ -702,6 +702,9 @@ int BN_cmp(const BIGNUM *a, const BIGNUM *b)
                 { gt=1; lt= -1; }
         else    { gt= -1; lt=1; }
 
+        bn_fix_top(a);
+        bn_fix_top(b);
+
         if (a->top > b->top) return(gt);
         if (a->top < b->top) return(lt);
         for (i=a->top-1; i>=0; i--)