tree b61582514826d5c24c368155964579b35e7ec3c6
parent d154c7ccbc133c5e69a3a5281409ee50754eebe0
author David Benjamin <davidben@google.com> 1532129354 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1532130306 +0000

Clear r->neg in bn_mod_{add,sub}_consttime.

Otherwise, if the output BIGNUM was previously negative, we'd incorrectly give
a negative result. Thanks to Guide Vranken for reporting this issue!

Fortunately, this does not appear to come up in any existing caller. This isn't
all that surprising as negative numbers never really come up in cryptography.
Were it not for OpenSSL historically designing a calculator API, we'd just
delete the bit altogether. :-(

Bug: chromium:865924
Change-Id: I28fdc986dfaba3e38435b14ebf07453d537cc60a
Reviewed-on: https://boringssl-review.googlesource.com/29944
Commit-Queue: David Benjamin <davidben@google.com>
Commit-Queue: Adam Langley <agl@google.com>
Reviewed-by: Adam Langley <agl@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>