1 files changed, 55 insertions, 10 deletions

diff --git a/src/lib/libcrypto/bn/bn_word.c b/src/lib/libcrypto/bn/bn_word.c
index 988e0ca7b3..ee7b87c45c 100644
--- a/src/lib/libcrypto/bn/bn_word.c
+++ b/src/lib/libcrypto/bn/bn_word.c
@@ -69,6 +69,10 @@ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w)
 #endif
         int i;
 
+        if (w == 0)
+                return (BN_ULONG)-1;
+
+        bn_check_top(a);
         w&=BN_MASK2;
         for (i=a->top-1; i>=0; i--)
                 {
@@ -85,12 +89,24 @@ BN_ULONG BN_mod_word(const BIGNUM *a, BN_ULONG w)
 
 BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w)
         {
-        BN_ULONG ret;
-        int i;
+        BN_ULONG ret = 0;
+        int i, j;
+
+        bn_check_top(a);
+        w &= BN_MASK2;
+
+        if (!w)
+                /* actually this an error (division by zero) */
+                return (BN_ULONG)-1;
+        if (a->top == 0)
+                return 0;
+
+        /* normalize input (so bn_div_words doesn't complain) */
+        j = BN_BITS2 - BN_num_bits_word(w);
+        w <<= j;
+        if (!BN_lshift(a, a, j))
+                return (BN_ULONG)-1;
 
-        if (a->top == 0) return(0);
-        ret=0;
-        w&=BN_MASK2;
         for (i=a->top-1; i>=0; i--)
                 {
                 BN_ULONG l,d;
@@ -102,6 +118,8 @@ BN_ULONG BN_div_word(BIGNUM *a, BN_ULONG w)
                 }
         if ((a->top > 0) && (a->d[a->top-1] == 0))
                 a->top--;
+        ret >>= j;
+        bn_check_top(a);
         return(ret);
         }
 
@@ -110,6 +128,14 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
         BN_ULONG l;
         int i;
 
+        bn_check_top(a);
+        w &= BN_MASK2;
+
+        /* degenerate case: w is zero */
+        if (!w) return 1;
+        /* degenerate case: a is zero */
+        if(BN_is_zero(a)) return BN_set_word(a, w);
+        /* handle 'a' when negative */
         if (a->neg)
                 {
                 a->neg=0;
@@ -118,15 +144,17 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
                         a->neg=!(a->neg);
                 return(i);
                 }
-        w&=BN_MASK2;
-        if (bn_wexpand(a,a->top+1) == NULL) return(0);
+        /* Only expand (and risk failing) if it's possibly necessary */
+        if (((BN_ULONG)(a->d[a->top - 1] + 1) == 0) &&
+                        (bn_wexpand(a,a->top+1) == NULL))
+                return(0);
         i=0;
         for (;;)
                 {
                 if (i >= a->top)
                         l=w;
                 else
-                        l=(a->d[i]+(BN_ULONG)w)&BN_MASK2;
+                        l=(a->d[i]+w)&BN_MASK2;
                 a->d[i]=l;
                 if (w > l)
                         w=1;
@@ -136,6 +164,7 @@ int BN_add_word(BIGNUM *a, BN_ULONG w)
                 }
         if (i >= a->top)
                 a->top++;
+        bn_check_top(a);
         return(1);
         }
 
@@ -143,7 +172,21 @@ int BN_sub_word(BIGNUM *a, BN_ULONG w)
         {
         int i;
 
-        if (BN_is_zero(a) || a->neg)
+        bn_check_top(a);
+        w &= BN_MASK2;
+
+        /* degenerate case: w is zero */
+        if (!w) return 1;
+        /* degenerate case: a is zero */
+        if(BN_is_zero(a))
+                {
+                i = BN_set_word(a,w);
+                if (i != 0)
+                        BN_set_negative(a, 1);
+                return i;
+                }
+        /* handle 'a' when negative */
+        if (a->neg)
                 {
                 a->neg=0;
                 i=BN_add_word(a,w);
@@ -151,7 +194,6 @@ int BN_sub_word(BIGNUM *a, BN_ULONG w)
                 return(i);
                 }
 
-        w&=BN_MASK2;
         if ((a->top == 1) && (a->d[0] < w))
                 {
                 a->d[0]=w-a->d[0];
@@ -175,6 +217,7 @@ int BN_sub_word(BIGNUM *a, BN_ULONG w)
                 }
         if ((a->d[i] == 0) && (i == (a->top-1)))
                 a->top--;
+        bn_check_top(a);
         return(1);
         }
 
@@ -182,6 +225,7 @@ int BN_mul_word(BIGNUM *a, BN_ULONG w)
         {
         BN_ULONG ll;
 
+        bn_check_top(a);
         w&=BN_MASK2;
         if (a->top)
                 {
@@ -197,6 +241,7 @@ int BN_mul_word(BIGNUM *a, BN_ULONG w)
                                 }
                         }
                 }
+        bn_check_top(a);
         return(1);
         }