From c6ecafe6589675f83ca98bd5a3be89cf59281d1c Mon Sep 17 00:00:00 2001
From: tb <>
Date: Thu, 27 Aug 2026 07:18:40 +0000
Subject: rsa_eay: Replace handrolled BN_bn2binpad with the real thing

Just a tiny little bit of lipstick on this entelodont. This is simpler
and does not change behavior as BN_bn2binpad() returns -1 on failure and
num on success.

jsing points out that BN_bn2binpad() is constant time.

ok jsing kenjiro

PS: henning, you owe me a significant amount of quality beverages for
making me look at this particular tire fire (and corresponding XS files).
---
 src/lib/libcrypto/rsa/rsa_eay.c | 26 +++++++-------------------
 1 file changed, 7 insertions(+), 19 deletions(-)

(limited to 'src/lib')

diff --git a/src/lib/libcrypto/rsa/rsa_eay.c b/src/lib/libcrypto/rsa/rsa_eay.c
index 65ccfc35e1..0a88c812be 100644
--- a/src/lib/libcrypto/rsa/rsa_eay.c
+++ b/src/lib/libcrypto/rsa/rsa_eay.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rsa_eay.c,v 1.66 2025/05/10 05:54:38 tb Exp $ */
+/* $OpenBSD: rsa_eay.c,v 1.67 2026/08/27 07:18:40 tb Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -126,7 +126,7 @@ rsa_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
     RSA *rsa, int padding)
 {
 	BIGNUM *f, *ret;
-	int i, j, k, num = 0, r = -1;
+	int i, num = 0, r = -1;
 	unsigned char *buf = NULL;
 	BN_CTX *ctx = NULL;
 
@@ -200,15 +200,9 @@ rsa_public_encrypt(int flen, const unsigned char *from, unsigned char *to,
 	    rsa->_method_mod_n))
 		goto err;
 
-	/* put in leading 0 bytes if the number is less than the
-	 * length of the modulus */
-	j = BN_num_bytes(ret);
-	i = BN_bn2bin(ret, &(to[num - j]));
-	for (k = 0; k < num - i; k++)
-		to[k] = 0;
+	r = BN_bn2binpad(ret, to, num);
 
-	r = num;
-err:
+ err:
 	if (ctx != NULL) {
 		BN_CTX_end(ctx);
 		BN_CTX_free(ctx);
@@ -306,7 +300,7 @@ rsa_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
     RSA *rsa, int padding)
 {
 	BIGNUM *f, *ret, *res;
-	int i, j, k, num = 0, r = -1;
+	int i, num = 0, r = -1;
 	unsigned char *buf = NULL;
 	BN_CTX *ctx = NULL;
 	int local_blinding = 0;
@@ -412,15 +406,9 @@ rsa_private_encrypt(int flen, const unsigned char *from, unsigned char *to,
 	} else
 		res = ret;
 
-	/* put in leading 0 bytes if the number is less than the
-	 * length of the modulus */
-	j = BN_num_bytes(res);
-	i = BN_bn2bin(res, &(to[num - j]));
-	for (k = 0; k < num - i; k++)
-		to[k] = 0;
+	r = BN_bn2binpad(res, to, num);
 
-	r = num;
-err:
+ err:
 	if (ctx != NULL) {
 		BN_CTX_end(ctx);
 		BN_CTX_free(ctx);
-- 
cgit v1.2.3-55-g6feb