mmo-ref/dep-openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Acquire BN_sqr result before ctx sizing

Browse source 
Acquire the writable result before reading the operand dmax value for the
OSSL_FN_CTX arena size. This avoids stale context sizing when the result
aliases the operand and acquisition expands that BIGNUM.

Assisted-by: Pi:openai/gpt-5.5
Signed-off-by: Richard Levitte <levitte@openssl.foundation>

Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Reviewed-by: Igor Ustinov <igus@openssl.foundation>
MergeDate: Fri Jun 12 15:16:36 2026
(Merged from https://github.com/openssl/openssl/pull/31448)
This commit is contained in:
Richard Levitte 2026-06-10 20:00:43 +02:00 • committed by Tomas Mraz
parent 06bc8339d9
commit 1763d6aff3
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
crypto/bn/bn_sqr.c
View file

@ -29,7 +29,14 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
bn_check_top(a);
bn_check_top(r);
/*
* Acquiring rf may make r larger.
* If r == a, then a will also become larger. Therefore, max must
* be calculated after rf has been acquired.
*/
size_t top = a->top * 2;
OSSL_FN *rf = bn_acquire_ossl_fn(r, (int)top);
size_t max = a->dmax * 2;
/*
@ -38,7 +45,6 @@ int BN_sqr(BIGNUM *r, const BIGNUM *a, BN_CTX *ctx)
* (OSSL_FN_CTX is only really useful within OSSL_FN functionality)
*/
OSSL_FN_CTX *fnctx = OSSL_FN_CTX_new(NULL, 1, 2, max * 4);
OSSL_FN *rf = bn_acquire_ossl_fn(r, (int)top);
int ret = OSSL_FN_sqr(rf, a->data, fnctx);
bn_release(r, (int)top);
r->neg = 0;