summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/bn/bn_gf2m.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* GF2m bites the dust. It won't be missed.tb2023-04-251-1268/+0
|
* Replace the remaining BN_copy() with bn_copy()tb2023-03-271-9/+9
| | | | ok jsing
* Use bn_copy() rather than inlining ittb2023-03-271-2/+2
| | | | ok jsing
* Drop unnecessary parentheses.tb2023-03-271-3/+3
| | | | ok jsing
* Mop up more BN_DEBUG related code.jsing2022-11-301-6/+1
|
* Make internal header file names consistenttb2022-11-261-2/+2
| | | | | | | | | | | | | | | | Libcrypto currently has a mess of *_lcl.h, *_locl.h, and *_local.h names used for internal headers. Move all these headers we inherited from OpenSSL to *_local.h, reserving the name *_internal.h for our own code. Similarly, move dtls_locl.h and ssl_locl.h to dtls_local and ssl_local.h. constant_time_locl.h is moved to constant_time.h since it's special. Adjust all .c files in libcrypto, libssl and regress. The diff is mechanical with the exception of tls13_quic.c, where #include <ssl_locl.h> was fixed manually. discussed with jsing, no objection bcook
* Remove BIGNUM consistency macros.jsing2022-11-261-54/+1
| | | | | | | | | | | | Compiling with BN_DEBUG (and if you want to take it further, BN_DEBUG_RAND) supposedly adds consistency checks to the BN code. These are rarely if ever used and introduce a bunch of clutter in the code. Furthermore, there are hacks in place to undo things that the debugging code does. Remove all of this mess and instead rely on always enabled checks, more readable code and proper regress coverage to ensure correct behaviour. "Good riddance." tb@
* Change bn_expand()/bn_wexpand() to indicate failure/success via 0/1.jsing2022-11-241-2/+2
| | | | | | | | | Currently bn_expand()/bn_wexpand() return a BIGNUM *, however none of the callers use this (and many already treat it as a true/false value). Change these functions to return 0 on failure and 1 on success, revising callers that test against NULL in the process. ok tb@
* Fix a surprising quirk in BN_GF2m_mod(3).schwarze2022-11-201-5/+11
| | | | | | | | | | | | | | | | | | | | | | | | All other wrappers in the same file that use a temporary array of degrees size that array dynamically, such that they are able to handle reducing polynomials of arbitrary lengths. BN_GF2m_mod(3) was the only one that used a static array of size 6 instead, limiting it to trinomials and pentanomials and causing it to fail for longer reducing polynomials. Make this more uniform and less surprising by using exactly the same code as in all the other wrappers, such that BN_GF2m_mod(3) works with reducing polynomials of arbitrary length, too, just like the others. Again, tb@ points out this quirk is very unlikely to cause vulnerabilities in practice because cryptographic applications do not use longer reducing polynomials. This patch is not expected to significantly impact performance because the relevant caller, BN_GF2m_mod_div(3), already uses dynamic allocation via BN_GF2m_mod_mul(3). OK tb@
* Fix an off-by-one bug in BN_GF2m_poly2arr(3).schwarze2022-11-201-4/+3
| | | | | | | | | | | | | | | | | | | | | If the last argument, the size of the output array, is too small to contain all degrees present in the input polynomial plus one for the terminating -1, the function is documented to return the size of the output array that would be needed (in comments in the source code, in the new manual page, and by the way how the function is used by other functions in the same file). However, in case of overflow, the existing code failed to include the element needed for the terminating -1 in the return value, wrongly indicating success if everything but the -1 did fit and reporting failure with a size that was still too small otherwise. According to tb@, this is very unlikely to cause vulnerabilities in practical applications because there is no real reason to pick a reducing polynomial longer than a pentanomial, because all known callers use either fixed size arrays of size 6 or dynamic allocation, because use of GF(2^m) is rare in practice, and GF(2^m) with custom reducing polynomials even more so. OK tb@
* Send the function codes from the error functions to the bit bucket,beck2017-01-291-10/+9
| | | | | | as was done earlier in libssl. Thanks inoguchi@ for noticing libssl had more reacharounds into this. ok jsing@ inoguchi@
* Avoid undefined-behavior right-shifting by a word-size # of bits.bcook2016-09-031-3/+2
| | | | Found with STACK, originally from OpenSSL, ok @beck
* Add error handling to the remaining calls to bn_wexpand().bcook2016-03-121-4/+7
| | | | | | | Noticed by pascal-cuoq from Github: https://github.com/libressl-portable/openbsd/issues/56 ok beck@
* Avoid an infinite loop that can be triggered by parsing an ASN.1jsing2015-06-111-3/+8
| | | | | | | | | | | ECParameters structure that has a specially malformed binary polynomial field. Issue reported by Joseph Barr-Pixton and fix based on OpenSSL. Fixes CVE-2015-1788. ok doug@ miod@
* Add missing BN_CTX_end() calls.doug2015-04-291-2/+2
| | | | | | | | After calling BN_CTX_start(), there must be a BN_CTX_end() before returning. There were missing BN_CTX_end() calls in error paths. One diff chunk was simply removing redundant code related to this. ok deraadt@
* Remove unnecessary include of assert.hmiod2015-02-101-2/+1
|
* BN_CTX_get() can fail - consistently check its return value.jsing2015-02-091-16/+19
| | | | | | | | | | | | | | | There are currently cases where the return from each call is checked, the return from only the last call is checked and cases where it is not checked at all (including code in bn, ec and engine). Checking the last return value is valid as once the function fails it will continue to return NULL. However, in order to be consistent check each call with the same idiom. This makes it easy to verify. Note there are still a handful of cases that do not follow the idiom - these will be handled separately. ok beck@ doug@
* deregister; no binary changejsg2014-10-281-5/+5
| | | | ok jsing@ miod@
* Only import cryptlib.h in the four source files that actually need it.jsing2014-07-111-2/+3
| | | | | | | | Remove the openssl public includes from cryptlib.h and add a small number of includes into the source files that actually need them. While here, also sort/group/tidy the includes. ok beck@ miod@
* Explicitly include <openssl/opensslconf.h> in every file that referencesjsing2014-07-101-1/+4
| | | | | | | | | an OPENSSL_NO_* define. This avoids relying on something else pulling it in for us, plus it fixes several cases where the #ifndef OPENSSL_NO_XYZ is never going to do anything, since OPENSSL_NO_XYZ will never defined, due to the fact that opensslconf.h has not been included. This also includes some miscellaneous sorting/tidying of headers.
* tags as requested by miod and teduderaadt2014-06-121-1/+1
|
* ok, next pass after review: when possible, put the reallocarray argumentsderaadt2014-05-291-5/+5
| | | | in the "size_t nmemb, size_t size"
* convert 53 malloc(a*b) to reallocarray(NULL, a, b). that is 53deraadt2014-05-291-5/+5
| | | | | | | | | potential integer overflows easily changed into an allocation return of NULL, with errno nicely set if need be. checks for an allocations returning NULL are commonplace, or if the object is dereferenced (quite normal) will result in a nice fault which can be detected & repaired properly. ok tedu
* if (x) free(x) -> free(x); semantic patch generated with coccinelle, carefullymiod2014-05-221-10/+5
| | | | eyeballed before applying. Contributed by Cyril Roelandt on tech@
* Emergency knfectomie requested by tedu@.jsing2014-05-081-472/+678
|
* Try to clean the maze of <openssl/bn.h> defines regarding the BN internals.miod2014-04-241-10/+5
| | | | | | | | | | | | | | | | | | | | | | | The intent of this change is to only keep support for two kind of architectures: - those with 32-bit int and long, and 64-bit long long, where ``long * long -> long long'' multiplication routines are available. - those with 64-bit int and long, and no 128-bit long long type. This gets rid of the SIXTY_FOUR_BIT_LONG, SIXTY_FOUR_BIT (not the same!), THIRTY_TWO_BIT, SIXTEEN_BIT and EIGHT_BIT defines. After this change, the types and defines are as follows: arch: 64bit 32bit rationale BN_LLONG undefined defined defined if l * l -> ll BN_ULLONG undefined u long long result of BN_LONG * BN_LONG BN_ULONG u long u int native register size BN_LONG long int the same, signed BN_BITS 128 64 size of 2*BN_ULONG in bits BN_BYTES 8 4 size of 2*BN_ULONG in bytes BN_BITS2 64 32 BN_BITS / 2 Tested on various 32-bit and 64-bit OpenBSD systems of various endianness.
* Change library to use intrinsic memory allocation functions instead ofbeck2014-04-171-10/+10
| | | | | | | | OPENSSL_foo wrappers. This changes: OPENSSL_malloc->malloc OPENSSL_free->free OPENSSL_relloc->realloc OPENSSL_freeFunc->free
* resolve conflictsdjm2012-10-131-18/+96
|
* openssl-1.0.0e: resolve conflictsdjm2011-11-031-0/+1
|
* resolve conflicts, fix local changesdjm2010-10-011-102/+40
|
* cherrypick patch from OpenSSL 0.9.8m:djm2010-03-041-1/+2
| | | | | *) Always check bn_wexpend() return values for failure. (CVE-2009-3245) [Martin Olsson, Neel Mehta]
* update to openssl-0.9.8i; tested by several, especially krw@djm2009-01-051-1/+5
|
* import of OpenSSL 0.9.8hdjm2008-09-061-0/+1091
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-11 04:05:53 +0000