1 files changed, 29 insertions, 27 deletions

diff --git a/src/lib/libcrypto/bn/bn_exp2.c b/src/lib/libcrypto/bn/bn_exp2.c
index b3f43cec8c..73ccd58a83 100644
--- a/src/lib/libcrypto/bn/bn_exp2.c
+++ b/src/lib/libcrypto/bn/bn_exp2.c
@@ -120,11 +120,10 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
         BN_CTX *ctx, BN_MONT_CTX *in_mont)
         {
         int i,j,bits,b,bits1,bits2,ret=0,wpos1,wpos2,window1,window2,wvalue1,wvalue2;
-        int r_is_one=1;
+        int r_is_one=1,ts1=0,ts2=0;
         BIGNUM *d,*r;
         const BIGNUM *a_mod_m;
-        /* Tables of variables obtained from 'ctx' */
-        BIGNUM *val1[TABLE_SIZE], *val2[TABLE_SIZE];
+        BIGNUM val1[TABLE_SIZE], val2[TABLE_SIZE];
         BN_MONT_CTX *mont=NULL;
 
         bn_check_top(a1);
@@ -151,9 +150,7 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
         BN_CTX_start(ctx);
         d = BN_CTX_get(ctx);
         r = BN_CTX_get(ctx);
-        val1[0] = BN_CTX_get(ctx);
-        val2[0] = BN_CTX_get(ctx);
-        if(!d || !r || !val1[0] || !val2[0]) goto err;
+        if (d == NULL || r == NULL) goto err;
 
         if (in_mont != NULL)
                 mont=in_mont;
@@ -169,67 +166,69 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
         /*
          * Build table for a1:   val1[i] := a1^(2*i + 1) mod m  for i = 0 .. 2^(window1-1)
          */
+        BN_init(&val1[0]);
+        ts1=1;
         if (a1->neg || BN_ucmp(a1,m) >= 0)
                 {
-                if (!BN_mod(val1[0],a1,m,ctx))
+                if (!BN_mod(&(val1[0]),a1,m,ctx))
                         goto err;
-                a_mod_m = val1[0];
+                a_mod_m = &(val1[0]);
                 }
         else
                 a_mod_m = a1;
         if (BN_is_zero(a_mod_m))
                 {
-                BN_zero(rr);
-                ret = 1;
+                ret = BN_zero(rr);
                 goto err;
                 }
 
-        if (!BN_to_montgomery(val1[0],a_mod_m,mont,ctx)) goto err;
+        if (!BN_to_montgomery(&(val1[0]),a_mod_m,mont,ctx)) goto err;
         if (window1 > 1)
                 {
-                if (!BN_mod_mul_montgomery(d,val1[0],val1[0],mont,ctx)) goto err;
+                if (!BN_mod_mul_montgomery(d,&(val1[0]),&(val1[0]),mont,ctx)) goto err;
 
                 j=1<<(window1-1);
                 for (i=1; i<j; i++)
                         {
-                        if(((val1[i] = BN_CTX_get(ctx)) == NULL) ||
-                                        !BN_mod_mul_montgomery(val1[i],val1[i-1],
-                                                d,mont,ctx))
+                        BN_init(&(val1[i]));
+                        if (!BN_mod_mul_montgomery(&(val1[i]),&(val1[i-1]),d,mont,ctx))
                                 goto err;
                         }
+                ts1=i;
                 }
 
 
         /*
          * Build table for a2:   val2[i] := a2^(2*i + 1) mod m  for i = 0 .. 2^(window2-1)
          */
+        BN_init(&val2[0]);
+        ts2=1;
         if (a2->neg || BN_ucmp(a2,m) >= 0)
                 {
-                if (!BN_mod(val2[0],a2,m,ctx))
+                if (!BN_mod(&(val2[0]),a2,m,ctx))
                         goto err;
-                a_mod_m = val2[0];
+                a_mod_m = &(val2[0]);
                 }
         else
                 a_mod_m = a2;
         if (BN_is_zero(a_mod_m))
                 {
-                BN_zero(rr);
-                ret = 1;
+                ret = BN_zero(rr);
                 goto err;
                 }
-        if (!BN_to_montgomery(val2[0],a_mod_m,mont,ctx)) goto err;
+        if (!BN_to_montgomery(&(val2[0]),a_mod_m,mont,ctx)) goto err;
         if (window2 > 1)
                 {
-                if (!BN_mod_mul_montgomery(d,val2[0],val2[0],mont,ctx)) goto err;
+                if (!BN_mod_mul_montgomery(d,&(val2[0]),&(val2[0]),mont,ctx)) goto err;
 
                 j=1<<(window2-1);
                 for (i=1; i<j; i++)
                         {
-                        if(((val2[i] = BN_CTX_get(ctx)) == NULL) ||
-                                        !BN_mod_mul_montgomery(val2[i],val2[i-1],
-                                                d,mont,ctx))
+                        BN_init(&(val2[i]));
+                        if (!BN_mod_mul_montgomery(&(val2[i]),&(val2[i-1]),d,mont,ctx))
                                 goto err;
                         }
+                ts2=i;
                 }
 
 
@@ -286,7 +285,7 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
                 if (wvalue1 && b == wpos1)
                         {
                         /* wvalue1 is odd and < 2^window1 */
-                        if (!BN_mod_mul_montgomery(r,r,val1[wvalue1>>1],mont,ctx))
+                        if (!BN_mod_mul_montgomery(r,r,&(val1[wvalue1>>1]),mont,ctx))
                                 goto err;
                         wvalue1 = 0;
                         r_is_one = 0;
@@ -295,7 +294,7 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
                 if (wvalue2 && b == wpos2)
                         {
                         /* wvalue2 is odd and < 2^window2 */
-                        if (!BN_mod_mul_montgomery(r,r,val2[wvalue2>>1],mont,ctx))
+                        if (!BN_mod_mul_montgomery(r,r,&(val2[wvalue2>>1]),mont,ctx))
                                 goto err;
                         wvalue2 = 0;
                         r_is_one = 0;
@@ -306,6 +305,9 @@ int BN_mod_exp2_mont(BIGNUM *rr, const BIGNUM *a1, const BIGNUM *p1,
 err:
         if ((in_mont == NULL) && (mont != NULL)) BN_MONT_CTX_free(mont);
         BN_CTX_end(ctx);
-        bn_check_top(rr);
+        for (i=0; i<ts1; i++)
+                BN_clear_free(&(val1[i]));
+        for (i=0; i<ts2; i++)
+                BN_clear_free(&(val2[i]));
         return(ret);
         }