From 84697ca3591d958d5154005dc0e9831b1f453637 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 23 Jul 2020 01:16:46 +0200 Subject: [PATCH] Fix memory leak in mbedtls_mpi_sub_abs Fix a memory leak in mbedtls_mpi_sub_abs when the output parameter is aliased to the second operand (X = A - X) and the result is negative. Signed-off-by: Gilles Peskine --- library/bignum.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/library/bignum.c b/library/bignum.c index f42b97650..89a62a1c4 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -1366,7 +1366,10 @@ int mbedtls_mpi_sub_abs( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi /* If we ran out of space for the carry, it means that the result * is negative. */ if( n == X->n ) - return( MBEDTLS_ERR_MPI_NEGATIVE_VALUE ); + { + ret = MBEDTLS_ERR_MPI_NEGATIVE_VALUE; + goto cleanup; + } --X->p[n]; }