commit 6aea58d0eafb93e85312960b4eda01f344e29e12
author Adam Langley <agl@chromium.org> Fri Jun 20 12:00:00 2014 -0700
committer Adam Langley <agl@chromium.org> Fri Jun 20 13:17:33 2014 -0700
tree deb1c4983210ac9dded0570045fdaf0266910f1d
parent 1258b6a756674d63f172602d8041ccc0dffd03d1

Check for invalid divisors in BN_div.

crypto/bn/div.c

diff --git a/crypto/bn/div.c b/crypto/bn/div.c
index 5f92e9e..5fc43dc 100644
--- a/crypto/bn/div.c
+++ b/crypto/bn/div.c
@@ -122,8 +122,9 @@
   int no_branch = 0;
 
   /* Invalid zero-padding would have particularly bad consequences
-   * in the case of 'num'. */
-  if (num->top > 0 && num->d[num->top - 1] == 0) {
+   * so don't just rely on bn_check_top() here */
+  if ((num->top > 0 && num->d[num->top - 1] == 0) ||
+      (divisor->top > 0 && divisor->d[divisor->top - 1] == 0)) {
     OPENSSL_PUT_ERROR(BN, BN_div, BN_R_NOT_INITIALIZED);
     return 0;
   }