From 91070e43a6f33e6ce99f2d5779918f7d6b259dd6 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 23 Jul 2020 01:16:46 +0200 Subject: [PATCH] Fix memory leak in mbedtls_mpi_sub_abs Fix a memory leak in mbedtls_mpi_sub_abs when the output parameter is aliased to the second operand (X = A - X) and the result is negative. Signed-off-by: Gilles Peskine --- library/bignum.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/library/bignum.c b/library/bignum.c index 0e39e3a44..c4eb7b04b 100644 --- a/library/bignum.c +++ b/library/bignum.c @@ -1201,7 +1201,10 @@ int mbedtls_mpi_sub_abs( mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi /* If we ran out of space for the carry, it means that the result * is negative. */ if( n == X->n ) - return( MBEDTLS_ERR_MPI_NEGATIVE_VALUE ); + { + ret = MBEDTLS_ERR_MPI_NEGATIVE_VALUE; + goto cleanup; + } --X->p[n]; }