Set |bn->neg| to zero in |bn_set_words|.

If the values of any of the coordinates in the output point |r| were
negative during nistz256 multiplication, then the calls to
|bn_set_word| would result in the wrong coordinates being returned
(the negatives of the correct coordinates would be returned instead).
Fix that.

Change-Id: I6048e62f76dca18f625650d11ef5a051c9e672a4
Reviewed-by: David Benjamin <>
diff --git a/crypto/bn/bn.c b/crypto/bn/bn.c
index d960f12..0ecaf82 100644
--- a/crypto/bn/bn.c
+++ b/crypto/bn/bn.c
@@ -274,6 +274,7 @@
   /* |bn_wexpand| verified that |num| isn't too large. */
   bn->top = (int)num;
+  bn->neg = 0;
   return 1;