TEST_F(BNTest, ModSqrtInvalid): explain what's going on.

Change-Id: I00c115920deb732c5ad1605babd994966a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/99127
Reviewed-by: Xiangfei Ding <xfding@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>

crypto/fipsmodule/bn/bn_test.cc

diff --git a/crypto/fipsmodule/bn/bn_test.cc b/crypto/fipsmodule/bn/bn_test.cc
index b83db5a..ccaa404 100644
--- a/crypto/fipsmodule/bn/bn_test.cc
+++ b/crypto/fipsmodule/bn/bn_test.cc
@@ -2732,17 +2732,22 @@
 }
 
 TEST_F(BNTest, ModSqrtInvalid) {
+  // The modulus. `BN_mod_sqrt` is only defined for prime moduli, but this one
+  // is 1237 * 3709.
+  UniquePtr<BIGNUM> bn4588033 = ASCIIToBIGNUM("4588033");
+  ASSERT_TRUE(bn4588033);
+
+  // Two numbers that, when trying to take their square root via
+  // Tonelli-Shanks, will lead to an endless loop.
   UniquePtr<BIGNUM> bn2140141 = ASCIIToBIGNUM("2140141");
   ASSERT_TRUE(bn2140141);
   UniquePtr<BIGNUM> bn2140142 = ASCIIToBIGNUM("2140142");
   ASSERT_TRUE(bn2140142);
-  UniquePtr<BIGNUM> bn4588033 = ASCIIToBIGNUM("4588033");
-  ASSERT_TRUE(bn4588033);
 
-  // `BN_mod_sqrt` may fail or return an arbitrary value, so we do not use
-  // `TestModSqrt` or `TestNotModSquare`. We only promise it will not crash or
-  // infinite loop. (For some invalid inputs, it may even be non-deterministic.)
-  // See CVE-2022-0778.
+  // `BN_mod_sqrt` may fail or return an arbitrary value if fed a composite
+  // `p`, so we do not use `TestModSqrt` or `TestNotModSquare`. We only promise
+  // it will not crash or infinite loop. (For some invalid inputs, it may even
+  // be non-deterministic.) See CVE-2022-0778.
   BN_free(BN_mod_sqrt(nullptr, bn2140141.get(), bn4588033.get(), ctx()));
   ERR_clear_error();
   BN_free(BN_mod_sqrt(nullptr, bn2140142.get(), bn4588033.get(), ctx()));