mmo-ref/dep-openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Acquire BN_mul result before ctx sizing

Browse source 
Acquire the writable result before reading operand dmax values for the
OSSL_FN_CTX arena size. This avoids stale context sizing when the result
aliases an operand and acquisition expands that BIGNUM.

Assisted-by: Pi:openai/gpt-5.5
Signed-off-by: Richard Levitte <levitte@openssl.foundation>

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
MergeDate: Fri Jun 12 15:16:34 2026
(Merged from https://github.com/openssl/openssl/pull/31448)
This commit is contained in:
Richard Levitte 2026-06-10 20:00:01 +02:00 • committed by Tomas Mraz
parent 3eb0b45e63
commit 06bc8339d9
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
crypto/bn/bn_mul.c
View file

@ -27,7 +27,14 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
bn_check_top(b);
bn_check_top(r);
/*
* Acquiring rf may make r larger.
* If r == a, then a will also become larger. Therefore, max must
* be calculated after rf has been acquired.
*/
size_t top = a->top + b->top;
OSSL_FN *rf = bn_acquire_ossl_fn(r, (int)top);
size_t max = a->dmax + b->dmax;
/*
@ -36,7 +43,6 @@ int BN_mul(BIGNUM *r, const BIGNUM *a, const BIGNUM *b, BN_CTX *ctx)
* (OSSL_FN_CTX is only really useful within OSSL_FN functionality)
*/
OSSL_FN_CTX *fnctx = OSSL_FN_CTX_new(NULL, 1, 1, max);
OSSL_FN *rf = bn_acquire_ossl_fn(r, (int)top);
int ret = OSSL_FN_mul(rf, a->data, b->data, fnctx);
bn_release(r, (int)top);